[Devel] [PATCH hci-8.1 v2] ve: start the kthreads of a container in its ve namespace

[no-reply at sashiko.virtuozzo.com]

> The kthreadd of a container is forked from a worker that takes over the
> namespaces, root, credentials and cgroups of the task starting the
> container, but not its ve namespace, which is not part of nsproxy.
> 
> As task_ve follows the ve namespace, they all run as host tasks, and so
> do the usermode helpers they start, and so a core dump to a pipe in a
> container fails, since the host won't execute a file from an untrusted
> container disk.
> 
> Switch the worker into the ve namespace of the starting task as well,
> last, as setns() does.
> 
> Fixes: 4d033dd01fd3 ("ve: Make task_ve pointer ve namespace based")
> https://virtuozzo.atlassian.net/browse/VSTOR-152982
> Feature: ve: ve generic structures
> 
> Signed-off-by: Eva Kurchatova <eva.kurchatova at virtuozzo.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.vzint.dev/#/patchset/20261103173909.2589573-1-eva.kurchatova@virtuozzo.com?part=1