[Devel] [PATCH hci-8.1] ve: start the kernel threads of a container in its ve namespace

[Pavel Tikhomirov]

Reviewed-by: Pavel Tikhomirov <ptikhomirov at virtuozzo.com>

On 11/3/26 03:02, Eva Kurchatova wrote:
> The kthreadd and khelper of a container are forked from a worker that
> takes over the namespaces, root, credentials and cgroups of the task
> starting the container, but not its ve namespace, which nsproxy does
> not carry. As task_ve follows the ve namespace, they run as host tasks,
> and so do the usermode helpers the container starts: a core dump to a
> pipe in a container fails, because the host may not execute a file
> from an untrusted container disk.
> 
> Switch the worker into the ve namespace of the starting task as well.
> 
> Fixes: 4d033dd01fd3 ("ve: Make task_ve pointer ve namespace based")
> https://virtuozzo.atlassian.net/browse/VSTOR-152982
> Feature: ve: ve generic structures
> 
> Signed-off-by: Eva Kurchatova <eva.kurchatova at virtuozzo.com>
> ---
>  kernel/ve/ve.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/kernel/ve/ve.c b/kernel/ve/ve.c
> index 8df881039c3c..ad0d1cf9d5f9 100644
> --- a/kernel/ve/ve.c
> +++ b/kernel/ve/ve.c
> @@ -25,6 +25,7 @@
>  #include <linux/mm.h>
>  #include <linux/kthread.h>
>  #include <linux/nsproxy.h>
> +#include <linux/ve_namespace.h>
>  #include <linux/fs_struct.h>
>  #include <linux/time_namespace.h>
>  #include <linux/blkdev.h>
> @@ -434,6 +435,8 @@ static void kthread_attach_fn(struct kthread_work *w)
>  
>  	get_nsproxy(target->nsproxy);
>  	switch_task_namespaces(current, target->nsproxy);
> +	/* task_ve follows the ve namespace, which nsproxy does not switch */
> +	switch_ve_namespace(current, get_ve_ns(target->ve_ns));
>  
>  	err = unshare_fs_struct();
>  	if (err)

-- 
Best regards, Pavel Tikhomirov
Senior Software Developer, Virtuozzo.