Linux Namespace

-JOVY/BNFTQBDF !NBTBNJ

5BCMFPG$POUFOUT w /BNFTQBDFPWFSWJFX w 4ZTUFNDBMMT w LFSOFMJNQMFNFOUBUJPO w /BNFTQBDF&YBNQMF

OBNFTQBDF PWFSWJFX

/BNFTQBDF w Ϧιʔε w ॴҦίϯςφܕԾ૝ԽΛ࣮ݱ͢Δ্Ͱॏཁͳػ ೳͷҰͭ

3FTPVSDF w /BNFTQBDFʹ͓͚ΔϦιʔε w DQV΍NFNPSZͱݴͬͨ෺ཧతͳܭࢉࢿݯͰ ͸ͳ͍ w ϗετ໊ɺωοτϫʔΫઃఆɺQJEͳͲͷΧʔω ϧ͕ѻ͏σʔλ

'FBUVSF w ϓϩηεؒͰΧʔωϧͷϦιʔεΛڞ༗ w GPSL ͷ࣮ߦ࣌͸਌ϓϩηεͱϦιʔεΛڞ༗ w OBNFTQBDFຖʹಠཱͨ͠Ϧιʔε w
໊લۭؒͷঢ়ଶΛม͑ΔΑ͏ͳॲཧΛߦͬͯ΋ ผͷ໊લۭؒʹଐ͢Δϓϩηεʹ͸Өڹ͸ٴ͹ ͳ͍

/BNFTQBDFSFQSFTFOUBUJPO w ໊લۭؒ͸ϑΝΠϧͱͯ͠Ϣʔβʔۭ͔ؒΒݟ͑ Δ w TFUOT Ͱར༻ masami@miko:~$ ls
-l /proc/self/ns total 0 dr-x--x--x 2 masami masami 0 Aug 31 00:15 . dr-xr-xr-x 8 masami masami 0 Aug 31 00:15 .. lrwxrwxrwx 1 masami masami 0 Aug 31 00:15 ipc -> ipc:[4026531839] lrwxrwxrwx 1 masami masami 0 Aug 31 00:15 mnt -> mnt:[4026531840] lrwxrwxrwx 1 masami masami 0 Aug 31 00:15 net -> net:[4026531957] lrwxrwxrwx 1 masami masami 0 Aug 31 00:15 pid -> pid:[4026531836] lrwxrwxrwx 1 masami masami 0 Aug 31 00:15 user -> user:[4026531837] lrwxrwxrwx 1 masami masami 0 Aug 31 00:15 uts -> uts:[4026531838]

/BNFTQBDFT w VUT w OFU w QJE w NOU w
JQD w VTFS

VUTOBNFTQBDF w ϗετ໊ɺυϝΠϯ໊ͳͲͷσʔλ w Χʔωϧόʔδϣϯ౳΋͋Δ͕มߋෆՄ w ήετ͕ࣗϗετ໊Λม͑ͯ΋ϗετ04ଆʹ͸ Өڹ͸Ͱͳ͍

OFUOBNFTQBDF w ωοτϫʔΫؔ࿈ͷϦιʔε w /FUXPSLEFWJDF w *1BEESFTT w 3PVUJOHUBCMF w
'JMUFSJOHUBCMF w 1PSUOVNCFS w QSPDOFU w FUDʜ

QJEOBNFTQBDF w ਌ϓϩηεͱ͸ผͷQJEΛར༻Մೳʹ w OBNFTQBDF"ͷQJEɿͱOBNFTQBDF#ͷ QJEɿ͸ผͷଘࡏ w QSPDGTΛద੾ʹ෼͚Ε͹ଞͷOBNFTQDFͷϓϩ ηεΛࢀরͰ͖ͳ͘ͳΔ

NOUOBNFTQBDF w Ϛ΢ϯτ͍ͯ͠ΔϑΝΠϧγεςϜΛද͢ w ໊લۭؒ෼཭࣌͸਌ϓϩηεͷNOUOBNFTQBDF Λίϐʔ w ෼཭ޙʹ਌ϓϩηε͕VTCTUJDLͳͲΛϚ΢ϯ τͯ͠΋ήετଆ͔Β͸ݟ͑ͳ͍

JQDOBNFTQBDF w 4ZTUFN7*1$Ͱ࢖༻͢ΔϦιʔεΛ෼཭ w ڞ༗ϝϞϦɺηϚϑΥɺϝοηʔδΩϡʔ

VTFSOBNFTQBDF w ϗετͱ͸ผͷVJEHJEମܥΛ࣋ͯΔ w ϗετͷVJEHJEͱήετͷVJEHJEϚοϐϯά͕ඞཁ w ઃఆ͠ͳ͍ͱ͕ઃఆ͞ΕΔ w HSPVQT͸൪ͷHSPVQೖΓ͢Δ w
ଞͷOBNFTQBDFͱҧ͍ɺಠཱ͍ͯ͠ͳ͍ w ଞͷOBNFTQBDFۭؒ͸ݸʑʹVTFSOBNFTQBDFΛ͍࣋ͬͯΔ w ֤OBNFTQBDFͷίϐʔॲཧؔ਺͸VTFSOTΛड͚औΔͷͰ HFU@VTFS@OT ͰࢀরΧ΢ϯτΛ૿΍͍ͯ͠Δ

VJEHJENBQQJOH w ϚοϐϯάΛߦ͏γεςϜίʔϧ͸ແ͍ w ҎԼͷϑΝΠϧΛ༻͍ͯϚοϐϯάΛ࣮ࢪ w QSPDQJEVJE@NBQ w QSPDQJEHJE@NBQ

VJEHJENBQQJOH w ήετͷVJEΛϗετͷVJEʹϚοϐϯά w HJE΋ಉ༷ʹ masami@miko:~$ ./a.out -U -M '0
1000 1' -G '0 1000 1' bash root@miko:~# id uid=0(root) gid=0(root) groups=0(root),65534 root@miko:~# cat /proc/self/uid_map /proc/self/gid_map 0 1000 1 0 1000 1 root@miko:~# touch test.txt root@miko:~# ls -la test.txt -rw-r--r-- 1 root root 0 Aug 31 12:00 test.txt root@miko:~# """"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""" """"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""" masami@miko:~$ ls -la test.txt -rw-r--r-- 1 masami masami 0 Aug 31 12:00 test.txt masami@miko:~$

*OBOVTFSOBNFTQBDF wϚοϐϯάͳ͠ͰVTFSOBNFTQBDFΛVOTIBSF I have no name!@miko:/proc/640$ ls -la /usr/bin/sudo -rwsr-xr-x
1 65534 65534 142792 May 9 15:58 /usr/bin/sudo ! w௨ৗͷঢ়ଶ I have no name!@miko:/proc/640$ exit logout masami@miko:~$ ls -la /usr/bin/sudo -rwsr-xr-x 1 root root 142792 May 9 15:58 /usr/bin/sudo

IPXUPVJEHJENBQQJOH DMPOF ΛݺͿ $-0/&@/&864&3ΛqBHTʹηοτ FYFD ܥͷγεςϜίʔϧΛݺͿલʹϚοϐϯάΛߦ͏
QSPDDIJMEQSPDFTTQJEVJE@NBQ QSPDDIJMEQSPDFTTQJEHJE@NBQ FYFD ܥͷؔ਺ΛݺΜͰ৽ͨͳϓϩάϥϜΛ࣮ߦ

TZTUFNDBMMT

TZTUFNDBMMT w DMPOF w VOTIBSF w
TFUOT

DMPOF w DMPOF ͰQJEOBNFTQBDFΛ෼཭ͨ͠৔ w ࢠϓϩηε͔ΒݟΔͱࣗ෼ͷQJE͸ͱͯ͠ݟ͑Δ w
਌ϓϩηε͔Β͸਌ϓϩηεͷQJEOBNFTQBDFͰͷ QJE͕ৼΒΕͨΑ͏ʹݟ͑Δ w DMPOF ͷ໭Γ஋Λ࢖ͬͯXBJUQJE Ͱ଴ͭ͜ͱ ͕Ͱ͖Δ

DMPOF $-0/&@/&8654 VUTOBNFTQBDF $-0/&@/&81*% QJEOBNFDQBDF $-0/&@/&8/4 NOUOBNFTQBDF $-0/&@/&8/&5 OFUOBNFTQBDF
$-0/&@/&8*1$ JQDOBNFTQBDF $-0/&@/&864&3 VTFSOBNFTQBDF DMPOF Ͱ࢖༻͢Δϑϥά͸TDIFEIΛJODMVEFͯ͠࢖༻Ͱ͖Δ͕ɺ $-0/&@/&864&3͸@(/6@4063$&ΛEFpOF͢Δඞཁ͋Γ

VOTIBSF w ࣗ෼Λ਌ϓϩηεͷ໊લۭ͔ؒΒ෼཭ͤ͞Δ w QJEOBNFTQBDF͸෼཭Ͱ͖ͳ͍ w Ұ࣌ظαϙʔτ͞Ε͍͕͔ͯͨΒର৅֎ʹͳͬͨ w QJEOT%POUIBWFVOTIBSF
$-0/&@/&81*% JNQMZ $-0/&@5)3&"% w IUUQTHJUIVCDPNUPSWBMETMJOVYDPNNJU FDFCECGDCGEEF w VOTIBSF ͷ৔߹ΤϥʔʹͳΒͳ͍͕Կ΋͓͖ͳ͍

TFUOT w طଘͷ໊લۭؒʹࣗ਎ΛࢀՃͤ͞Δ w DMPOF ɺVOTIBSF ͸਌ͷ໊લۭ͔ؒΒ෼཭ͯ͠৽نͷ
໊લۭؒΛ࣋ͭΑ͏ʹͳΔ w ໊લۭؒ΁ͷࢀՃʹ͸ର৅ͷ໊લۭؒͷϑΝΠϧσΟεΫϦϓ λΛ࢖༻͢Δ w ผͷQJEOBNFTQBDFʹࢀՃ͢Δ৔߹ɺϓϩηεࣗ਎ͷQJE͸ มΘΒͳ͍ w ࢠϓϩηε͔ΒQJE͕มΘΔ

LFSOFM JNQMFNFOUBUJPO

LFSOFMOTQSPYZD w OBNFTQBDFڞ௨ͷॲཧΛߦ͏ w OBNFTQBDFͷ࡞੒ɺίϐʔͳͲ w ݸʑͷOBNFTQBDFʹ͍ͭͯ͸ͦΕͧΕ͕࣮ࢪ

LFSOFMOTQSPYZD w લεϥΠυͰOBNFTQBDFڞ௨ͱઆ໌͚ͨ͠Ͳ w VTFSOBNFTQBDF͸ѻ͍ͬͯͳ͍ w VTFSOBNFTQBDF͸DSFED΍ݸʑͷ OBNFTQBDF͕؅ཧ

TUSVDUOTQSPYZ w ֤OBNFTQBDFͷσʔλΛอ࣋͢Δߏ଄ମ ! struct nsproxy { atomic_t count; struct
uts_namespace *uts_ns; struct ipc_namespace *ipc_ns; struct mnt_namespace *mnt_ns; struct pid_namespace *pid_ns_for_children; struct net *net_ns; }; wVTFSOBNFTQBDF͸TUSVDUDSFEʹͯ؅ཧ wTUSVDUUBTL@TUSVDUͷSFBM@DSFBE͔ΒVTFSOBNFTQBDFΛࢀর

DPNNPOOBNFTQBDF TUSVDUVSF w ֤OBNFTQBDF͸ҎԼͷม਺Λඞͣ࣋ͭ w ࢀরΧ΢ϯλ w QSPDGTͷJOPEF൪߸ w VTFSOBNFTQBDF
w VTFSOBNFTQBDFͷ৔߹͸਌ϓϩηε΁ͷϙΠϯλ

JOJU@OTQSPYZ w ࠷ॳͷϓϩηεʹઃఆ͞ΕΔOTQSPYZߏ଄ମ w ͜ΕҎ߱͸GPSLܥؔ਺ͷݺͼग़࣌͠ʹ͜ͷߏ ଄ମͷࢀরΧ΢ϯλΛΠϯΫϦϝϯτ w OBNFTQBDFΛ෼͚ͳ͍৔߹ɿʣ

TUSVDUOTQSPYZ w NPVOUOBNFTQBDFҎ֎͸Ϗϧυ࣌ʹઃఆ struct nsproxy init_nsproxy = { .count =
ATOMIC_INIT(1), .uts_ns = &init_uts_ns, #if defined(CONFIG_POSIX_MQUEUE) || defined(CONFIG_SYSVIPC) .ipc_ns = &init_ipc_ns, #endif .mnt_ns = NULL, .pid_ns_for_children = &init_pid_ns, #ifdef CONFIG_NET .net_ns = &init_net, #endif };

*OJUJBMJ[FNOU@OT wJOJU@NPVOU@USFF ͔Β͕࣮ࡍͷॲཧ start_kernel() @init/main.c --> vfs_caches_init() @fs/dcache.c --> mnt_init()
@fs/namespace.c --> init_mount_tree() @fs/namespace.c --> create_mnt_ns() @fs/namespace.c

*OJUJBMJ[FVTFS@OT w VTFS@OT͸TUSVDUDSFEͷσʔλॳظԽ࣌ʹઃఆ struct cred init_cred = { .usage =
ATOMIC_INIT(4), ~ུ~ .cap_bset = CAP_FULL_SET, .user = INIT_USER, .user_ns = &init_user_ns,

DPQZ@OBNFTQBDF w JOUDPQZ@OBNFTQBDFT VOTJHOFEMPOHqBHT TUSVDU UBTL@TUSVDU UTL w DPQZ@QSPDFTT
ΑΓݺ͹ΕΔ w qBHʹ$-0/&@/&8999͕ηοτ͞Ε͍ͯͳ͚Ε͹Χ ϨϯτϓϩηεͷOTQSPYZߏ଄ମͷࢀরΧ΢ϯλΛ w ͦ͏Ͱͳ͚Ε͹DSFBUF@OFX@OBNFTQBDF Ͱ֘౰͢Δ OBNFTQBDFΛ࡞੒͢Δ

TXJUDI@UBTL@OBNFTQBDF w WPJETXJUDI@UBTL@OBNFTQBDFT TUSVDU UBTL@TUSVDU UTL TUSVDUOTQSPYZ OFX w
ΧϨϯτϓϩηεͷ໊લۭؒ੾Γସ͑Λߦ͏ w VOTIBSF Ͱ࢖༻ w ϓϩηεͷFYJU ࣌ʹ΋࢖༻ w ੾Γସ͑ઌͷOBNFTQBDFʹ/6--Λઃఆ

TXJUDI@UBTL@OBNFTQBDF w OBNFTQBDFΛ੾Γସ͑ͨ݁Ռɺ੾Γସ͑લͷ OBNFTQBDFΛࢀর͢Δϓϩηε͕͍ͳ͘ͳͬͨ ৔߹ w GSFF@OTQSPYZ ΛݺΜͰOBNFTQBDFΛղ์

GSFF@OTQSPYZ w WPJEGSFF@OTQSPYZ TUSVDUOTQSPYZ OT w OBNFTQBDFͷղ์ w ֤OBNFTQBDFͷࢀরΧ΢ϯλΛσΫϦϝϯτ
w OTQSPYZߏ଄ମͷΠϯελϯεղ์ w ௨ৗ͸ϓϩηεͷFYJU࣌ʹ࣮ߦ͞ΕΔ

VOTIBSF@OTQSPYZ@OBNFTQBDF w JOUVOTIBSF@OTQSPYZ@OBNFTQBDFT VOTJHOFE MPOHVOTIBSF@qBHT TUSVDUOTQSPYZ OFX@OTQ TUSVDUDSFE OFX@DSFE TUSVDU
GT@TUSVDU OFX@GT w VOTIBSF ͷ࣮ߦ࣌ʹݺ͹ΕΔ w DSFBUF@OFX@OBNFTQBDF Ͱ໊લۭؒΛ৽نʹ ࡞੒

QSPDGTPQFSBUJPOT w OBNBTQBDF͸QSPDGTͰදݱ͞ΕΔͷͰ͜ΕΒΛૢ࡞͢Δؔ਺ Λొ࿥ w TFUOT ͕࢖͏ͷ͕͜ΕΒ w ֤OBNFTQBDFຖʹొ࿥
struct proc_ns_operations { const char *name; int type; void *(*get)(struct task_struct *task); void (*put)(void *ns); int (*install)(struct nsproxy *nsproxy, void *ns); unsigned int (*inum)(void *ns); };

QSPDGTPQFSBUJPOT w HFU w ର৅OBNFTQBDFͷࢀরΧ΢ϯλΛ w QVU
w ର৅OBNFTQBDFͷࢀরΧ΢ϯλΛ w JOTUBMM w ݱࡏͷOBNFTQBDFͷࢀরΧ΢ϯλΛ͠ɺ৽͍͠OBNFTQBDFΛOTQSPYZߏ ଄ମʹηοτ w JOVN w OBNFTQBDFͷJOPEF൪߸Λฦ͢

DMPOF w OBNFTQBDFͷૢ࡞ͱݴͬͯ΋DMPOF ݻ༗ͰԿ͔͕͋ΔΘ ͚Ͱ͸ແ͍ w DPQZ@QSPDFTT ͔ΒҎԼͷؔ਺ΛݺͿ w DPQZ@DSFET
w VTFS@OTͷίϐʔ৽ن࡞੒ w DPQZ@OBNFTQBDF w طଘͷ֤OBNFTQBDFͷίϐʔ৽ن࡞੒

TFUOT ೖΓ͍ͨOBNFTQBDFͷpMFߏ଄ମ͔ΒJOPEFΛऔಘ͠ɺ֘౰ OBNFTQBDFͷQSPD@OT@PQFSBUJPOTߏ଄ମऔಘ DSFBUF@OFX@OBNFTQBDF ͰOTQSPYZͷ࡞੒ w ɹqBHTʹ͸Λ౉͢ͷͰطଘͷOBNFTQBDFͷࢀরΧ΢ϯλ ͕૿͑Δ͚ͩ QSPD@OT@PQFSBUJPOTߏ଄ମͷJOTUBMM ΛݺΜͰOTQSPYZʹର
৅ͷOBNFTQBDFΛઃఆ TXJUDI@UBTL@OBNFTQBDFT ͰOBNFTQBDFͷ੾Γସ͑Λ࣮ࢪ

VOTIBSF VOTIBSF͢ΔOBNFTQBDFͷऔಘ ϑΝΠϧγεςϜͷVOTIBSF DVSSFOUλεΫͷGT@TUSVDUߏ଄ମ͕ίϐʔ͞ΕΔ ϑΝΠϧσΟεΫϦϓλͷίϐʔ w ։͍͍ͯΔϑΝΠϧσΟεΫϦϓλΛEVQ@GE Ͱίϐʔ VTFSOBNFTQBDFͷ෼཭ w
$-0/&@/&864&3͕ηοτ͞Ε͍ͯͳ͚Ε͹Կ΋͠ͳ͍

VOTIBSF ! VOTIBSF@OTQSPYZ@OBNFTQBDFT ͰͦͷଞOBNFTQBDFͷ෼཭ w ࣮ࡍͷॲཧ͸DSFBUF@OFX@OBNFTQBDFT Ͱ࣮ࢪ ্ه·Ͱͷૢ࡞ͰԿ͔͠Β࣮ߦ͕ߦΘΕͨ৔߹͸ҎԼͷॲཧΛ࣮ࢪ w OBNFQBDF
OTQSPYZ ͷมߋ͕͋ͬͨ৔߹͸TXJUDI@UBTL@OBNFTQBDFT Ͱ੾ Γସ͑ w GT@TUSVDUΛίϐʔͨ͠৔߹͸DVSSFOUλεΫͷGT@TUSVDUߏ଄ମ੾Γସ͑ ɹϑΝΠϧσΟεΫϦϓλΛίϐʔͨ͠৔߹͸DVSSFOUλεΫͷϑΝΠϧσΟεΫϦ ϓλ੾Γସ͑ ɹVTFS@OTͷVOTIBSFΛͨ͠৔߹͸TUSVDUDSFEͷ੾Γସ͑

/BNFTQBDF&YBNQMF w /BNFTQBDFػೳͰͲͷΑ͏ʹมΘ͔ͬͨ

HFUQJE w UBTL@TUSVDUߏ଄ମͷϝϯόม਺ QJE Λͦͷ·· ฦ٫Մೳ #define getpid() (current->pid)

HFUQJE wϓϩηε͕ॴଐ͍ͯ͠ΔQJEOBNFTQBDFͷQJEΛ ฦ͢ඞཁ͕͋Δ getpid() -> task_tgid_vnr() -> task_tgid() ->
pid_vnr() -> task_active_pid_ns() -> task_pid() -> ns_of_pid() -> pid_nr_ns()

DIPXO static int chown_common(struct dentry * dentry, uid_t user,
gid_t group) { ~தུʙ if (user == (uid_t) -1) user = inode->i_uid; if (group == (gid_t) -1) group = inode->i_gid; newattrs.ia_mode = inode->i_mode; newattrs.ia_uid = user; newattrs.ia_gid = group;

DIPXO static int chown_common(struct path *path, uid_t user, gid_t
group) { ~தུʙ uid = make_kuid(current_user_ns(), user); gid = make_kgid(current_user_ns(), group); ! newattrs.ia_valid = ATTR_CTIME; if (user != (uid_t) -1) { if (!uid_valid(uid)) return -EINVAL; newattrs.ia_valid |= ATTR_UID; newattrs.ia_uid = uid; } if (group != (gid_t) -1) { if (!gid_valid(gid)) return -EINVAL; newattrs.ia_valid |= ATTR_GID; newattrs.ia_gid = gid; }

3FGFSFODF w -9$ͰֶͿίϯςφೖ໳ʵܰྔԾ૝Խ؀ڥΛ࣮ݱ͢Δٕज़ w IUUQHJIZPKQBENJOTFSJBMMJOVY@DPOUBJOFST w /BNFTQBDFTJO0QFSBUJPOTFSJFT w IUUQMXOOFU"SUJDMFTTFSJFT@JOEFY w
1SPGFTTJPOBM-JOVY,FSOFM"SDIJUFDUVSF w IUUQXXXBNB[PODPKQEQ#5*$;

Linux Namespace

Linux Namespace

More Decks by Masami Ichikawa

Other Decks in Programming

Featured

Transcript