Add support for --pid=container:<id> #22481

mrunalp · 2016-05-03T18:11:40Z

This is for #22479

I will take out the engine-api code once docker/engine-api#218 is merged.

Signed-off-by: Mrunal Patel mrunalp@gmail.com

hqhq · 2016-05-05T02:52:22Z

For reference, it'll Closes: #10163

mrunalp · 2016-05-05T18:00:29Z

This is ready to test/review.

tiborvass · 2016-05-05T19:38:23Z

Maintainers (from today's review session) agree with the design, so moving to code review.

mrunalp · 2016-05-05T19:48:51Z

@tiborvass Thanks for the update! We need to get docker/engine-api#218 reviewed/merged as well.

thaJeztah · 2016-05-06T00:05:48Z

@mrunalp its merged 😄 👍

mrunalp · 2016-05-06T04:00:16Z

@thaJeztah yeah, now waiting for the vendor PR #22538 :)

thaJeztah · 2016-05-06T09:38:15Z

@mrunalp done as well \o/

mrunalp · 2016-05-06T18:57:11Z

@thaJeztah Thanks! I have rebased this PR to pick up the engine-api update.

LK4D4 · 2016-05-09T16:20:48Z

LGTM

icecrime · 2016-05-11T23:14:11Z

Ping @mlaventure!

mlaventure · 2016-05-12T03:30:21Z

daemon/create.go

+			return nil, err
+		}
+
+		return label.DupSecOpt(c.ProcessLabel), nil


If we have both ipcMode.IsContainer() and pidMode.IsContainer() are true and they both point to different containers with different labels we will never apply the second container labels.

I'm no selinux expert, but shouldn't those be merged somehow?

We can't join two namespaces of two different containers unless transitively they have the same label.
Cc: @rhatdan

Sent from my iPhone

On May 11, 2016, at 8:32 PM, Kenfe-Mickaël Laventure notifications@github.com wrote:

In daemon/create.go:

@@ -150,6 +150,14 @@ func (daemon *Daemon) generateSecurityOpt(ipcMode containertypes.IpcMode, pidMod

return label.DupSecOpt(c.ProcessLabel), nil }

if pidContainer := pidMode.Container(); pidContainer != "" {

c, err := daemon.GetContainer(pidContainer)

if err != nil {

return nil, err

}

return label.DupSecOpt(c.ProcessLabel), nil
If we have both ipcMode.IsContainer() and pidMode.IsContainer() are true and they both point to different containers with different labels we will never apply the second container labels.

I'm no selinux expert, but shouldn't those be merged somehow?

—
You are receiving this because you were mentioned.
Reply to this email directly or view it on GitHub

In order for two containers to share the same PID or same IPC Namespace, they have to run with the same SELinux label. Otherwise SELinux will break when a process in container1 tries to look at the processes in container2, or a process in container 1 tries to use an IPC created in container2. This is why when the second container is created it switches to the first containers labels. By merging the containers namespaces, you are saying that they share the same security structure, from an SELinux point of view.

is ipc=<container-A>, pid=<container-B> a valid configuration, or should that produce an error?

It's valid if they have the same selinux configuration it seems. Which
should check for this or prohibit it entirely to avoid runtime error later
on I'd say.

On Thu, May 12, 2016, 5:19 AM Sebastiaan van Stijn notifications@github.com
wrote:

In daemon/create.go
#22481 (comment):

@@ -150,6 +150,14 @@ func (daemon *Daemon) generateSecurityOpt(ipcMode containertypes.IpcMode, pidMod

return label.DupSecOpt(c.ProcessLabel), nil }

if pidContainer := pidMode.Container(); pidContainer != "" {

c, err := daemon.GetContainer(pidContainer)

if err != nil {

return nil, err

}

return label.DupSecOpt(c.ProcessLabel), nil

is ipc=, pid= a valid configuration, or should
that produce an error?

—
You are receiving this because you were mentioned.
Reply to this email directly or view it on GitHub
https://github.com/docker/docker/pull/22481/files/0c5d257326331f2bcaf03a4b3147d3225acf09c7#r63009686

Would it be bad to keep it simple for now, and require them to be the same container? (as in "no is temporary, yes is forever")?

You could release note it. Not sure if their would be other problems. Combining containers together without combining their security attributes could lead to some weird errors. Right now we keep seccomp, apparmor and capabiltiies separate, but you could figure out ways where weird bugs or priv escalations can happen. Basically one process with limited privs in one container causing a process in a different container through IPC or shared pid to do something more privileged.

Prohibiting joining ipc and pid from 2 different containers works for me as long as it's well documented.

We can extend it later to allow this case if both containers are using the same selinux configuration.

I have pushed an update that compares the pid and ipc labels for the use case and allows them only if they are same.

This also works for this example as the labels are the same transitively.

start container A container B joins --ipc:container:A container C joins --ipc:container:B --pid:container:A

mlaventure · 2016-05-13T18:53:34Z

daemon/create.go

+
+	if pidLabel != nil && ipcLabel != nil {
+		for i := 0; i < len(pidLabel); i++ {
+			if pidLabel[i] != ipcLabel[i] {


What if the labels are identical but not in the same order?

Could you clarify your question? If the labels are the same, then all the strings in the label array will match up.

So we can't have a scenario where

ipcLabel[0] = "label1" ; ipcLabel[1] = "label2" pidLabel[0] = "label2" ; pidLabel[1] = "label1"

?

@mlaventure No, that can't happen.

Ok, LGTM then! (IANAM)

On Fri, May 13, 2016, 8:33 PM Mrunal Patel notifications@github.com wrote:

In daemon/create.go
#22481 (comment):

return label.DupSecOpt(c.ProcessLabel), nil

pidLabel = label.DupSecOpt(c.ProcessLabel)

if ipcContainer == "" {

return pidLabel, err

}

}

if pidLabel != nil && ipcLabel != nil {

for i := 0; i < len(pidLabel); i++ {

if pidLabel[i] != ipcLabel[i] {

@mlaventure https://github.com/mlaventure No, that can't happen.

—
You are receiving this because you were mentioned.
Reply to this email directly or view it on GitHub
https://github.com/docker/docker/pull/22481/files/4772a40138e8f88e77f04049c1c2dc4865508dc7#r63270556

This works for me.

mrunalp · 2016-05-16T18:06:00Z

@thaJeztah ping. who else needs to review this? :) Also looks like janky failure is a test environment issue that should go away on restart.

thaJeztah · 2016-05-17T11:26:45Z

ping @LK4D4 @crosbymichael PTAL for the latest changes, let's get this merged 👍

thaJeztah · 2016-05-17T11:41:44Z

actually; this needs changes to the documentation, so please move it to "docs review" if it LGTY

@mrunalp The documentation needs to be updated to show this is now possible; preferably
with an example (explaining why someone would use this as an option?). I think it needs a note as well, explaining that, although --pid and --net can use different containers, their labels should match, if SELinux is used (don't know if we can come up with an example for having different containers for that?)

https://github.com/docker/docker/blob/master/docs/reference/run.md#pid-settings---pid

Man pages;

Also, the completion scripts need to be updated; let me know if you want to try
updating those yourself, or if @albers and @sdurrheimer need to assist. I think
the same approach can be taken as for the --net option (although I couldn't
find completion for container-names in the zsh script);

Random-Liu · 2016-05-17T16:37:53Z

/sub @Random-Liu

crosbymichael · 2016-05-17T21:53:35Z

LGTM

thaJeztah · 2016-05-17T23:00:22Z

moving to docs review with a LGTM from @mlaventure and @LK4D4

mrunalp · 2016-05-19T16:43:08Z

This is all green!

vdemeester · 2016-05-19T17:00:31Z

LGTM 🐸

Docker added support for sharing PID namespaces with other containers since version 1.12 (see moby/moby#22481). Signed-off-by: Stepan Stipl <stepan@stipl.net>

Backported from: moby#22481 Signed-off-by: Mrunal Patel <mrunalp@gmail.com> Signed-off-by: Qiang Huang <h.huangqiang@huawei.com>

Add support for --pid=container:<id> Backported from: moby#22481 Signed-off-by: Mrunal Patel <mrunalp@gmail.com> Signed-off-by: Qiang Huang <h.huangqiang@huawei.com> See merge request docker/docker!147

Docker added support for sharing PID namespaces with other containers since version 1.12 (see moby/moby#22481). Signed-off-by: Stepan Stipl <stepan@stipl.net>

GordonTheTurtle added the status/0-triage label May 3, 2016

mrunalp force-pushed the pid_container branch 3 times, most recently from ab8b67f to a51da5f Compare May 3, 2016 22:24

mrunalp changed the title ~~WIP: Add support for --pid=container:<id>~~ Add support for --pid=container:<id> May 5, 2016

vdemeester added status/1-design-review and removed status/0-triage labels May 5, 2016

tiborvass added status/2-code-review and removed status/1-design-review labels May 5, 2016

mrunalp force-pushed the pid_container branch from a51da5f to 0c5d257 Compare May 6, 2016 18:56

mlaventure reviewed May 12, 2016
View reviewed changes

mrunalp force-pushed the pid_container branch 3 times, most recently from 2f3566c to 4772a40 Compare May 13, 2016 18:48

mlaventure reviewed May 13, 2016
View reviewed changes

thaJeztah added this to the 1.12.0 milestone May 17, 2016

thaJeztah added status/3-docs-review and removed status/2-code-review labels May 17, 2016

Random-Liu mentioned this pull request May 18, 2016

Shared PID and UTS namespaces kubernetes/kubernetes#1615

Closed

vdemeester merged commit ebeb5a0 into moby:master May 19, 2016

thaJeztah added the impact/changelog label May 19, 2016

This was referenced May 31, 2016

Allow shared PID namespaces #10163

Closed

Support sharing pid namespaces between containers #22479

Closed

jimmyxian mentioned this pull request Jun 6, 2016

Keep track of the missing API in Swarm docker-archive/classicswarm#2333

Closed

23 tasks

pmorie mentioned this pull request Jun 9, 2016

Signal API proposal kubernetes/kubernetes#26884

Closed

sdurrheimer mentioned this pull request Jun 11, 2016

Add zsh completion for 'docker {create,run} --pid' values #23454

Merged

leseb mentioned this pull request Jun 16, 2016

daemon: new directory mode ceph/ceph-container#306

Merged

This was referenced Jul 11, 2016

docs: HostConfig.PidMode is not documented #24517

Closed

Add missing API docs for HostConfig.PidMode #24519

Merged

stepanstipl mentioned this pull request Aug 31, 2016

Allow custom PID mode for the container docker/docker-py#1177

Closed

WeiZhang555 pushed a commit to WeiZhang555/moby that referenced this pull request Nov 25, 2016

Add support for --pid=container:<id>

5f221b9

Backported from: moby#22481 Signed-off-by: Mrunal Patel <mrunalp@gmail.com> Signed-off-by: Qiang Huang <h.huangqiang@huawei.com>

This was referenced Feb 8, 2017

Dependency on --pid=host ceph/ceph-container#481

Closed

Dependency on --pid=host ceph/ceph-ansible#1297

Closed

tixxdz mentioned this pull request Nov 16, 2017

kernel: inclusion of KSPP patches that are still in development linuxkit/linuxkit#2745

Closed

thaJeztah mentioned this pull request Mar 15, 2023

api/types/container: fix handling of "container" mode, increase test-coverage #45167

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add support for --pid=container:<id> #22481

Add support for --pid=container:<id> #22481

mrunalp commented May 3, 2016

hqhq commented May 5, 2016

mrunalp commented May 5, 2016

tiborvass commented May 5, 2016

mrunalp commented May 5, 2016

thaJeztah commented May 6, 2016

mrunalp commented May 6, 2016

thaJeztah commented May 6, 2016

mrunalp commented May 6, 2016

LK4D4 commented May 9, 2016

icecrime commented May 11, 2016

mlaventure May 12, 2016

mrunalp May 12, 2016

rhatdan May 12, 2016

thaJeztah May 12, 2016

mlaventure May 12, 2016

thaJeztah May 12, 2016

rhatdan May 12, 2016

mlaventure May 12, 2016

mrunalp May 13, 2016

mrunalp May 13, 2016

mlaventure May 13, 2016

mrunalp May 13, 2016

mlaventure May 13, 2016

mrunalp May 14, 2016

mlaventure May 14, 2016

rhatdan May 14, 2016

mrunalp commented May 16, 2016

thaJeztah commented May 17, 2016

thaJeztah commented May 17, 2016 •

edited

Random-Liu commented May 17, 2016

crosbymichael commented May 17, 2016

thaJeztah commented May 17, 2016

mrunalp commented May 19, 2016

vdemeester commented May 19, 2016

Add support for --pid=container:<id> #22481

Add support for --pid=container:<id> #22481

Conversation

mrunalp commented May 3, 2016

hqhq commented May 5, 2016

mrunalp commented May 5, 2016

tiborvass commented May 5, 2016

mrunalp commented May 5, 2016

thaJeztah commented May 6, 2016

mrunalp commented May 6, 2016

thaJeztah commented May 6, 2016

mrunalp commented May 6, 2016

LK4D4 commented May 9, 2016

icecrime commented May 11, 2016

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mrunalp commented May 16, 2016

thaJeztah commented May 17, 2016

thaJeztah commented May 17, 2016 • edited

Random-Liu commented May 17, 2016

crosbymichael commented May 17, 2016

thaJeztah commented May 17, 2016

mrunalp commented May 19, 2016

vdemeester commented May 19, 2016

thaJeztah commented May 17, 2016 •

edited