[Devel] [PATCH hci-8.1] ve: start the kernel threads of a container in its ve namespace

[no-reply at sashiko.virtuozzo.com]

> The kthreadd and khelper of a container are forked from a worker that
> takes over the namespaces, root, credentials and cgroups of the task
> starting the container, but not its ve namespace, which nsproxy does
> not carry. As task_ve follows the ve namespace, they run as host tasks,
> and so do the usermode helpers the container starts: a core dump to a
> pipe in a container fails, because the host may not execute a file
> from an untrusted container disk.
> 
> Switch the worker into the ve namespace of the starting task as well.
> 
> Fixes: 4d033dd01fd3 ("ve: Make task_ve pointer ve namespace based")
> https://virtuozzo.atlassian.net/browse/VSTOR-152982
> Feature: ve: ve generic structures
> 
> Signed-off-by: Eva Kurchatova <eva.kurchatova at virtuozzo.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.vzint.dev/#/patchset/20261103020252.2464400-1-eva.kurchatova@virtuozzo.com?part=1