> Quoting Eric W. Biederman (
ebiederm@xmission.com):
> > Pavel Emelyanov <xemul@openvz.org> writes:
> > >>> I agree, that we should probably destroy this one when the task calls
> > >>> unshare, but trying to keep this list relevant is useless.
> > >>>
> > >> A very tricky question: Let's assume we have a process with two threads.
> > >> The undo structure is shared, as per opengroup standard.
> > >> Now one thread calls unshare(CLONE_NEWIPC). What should happen? We
> > >> cannot destroy the undo structure, the other thread might be still
> > >> interested in it.
> > >> If we allow sys_unshare() for multithreaded processes with CLONE_NEWIPC
> > >> and without CLONE_SYSVSEM, then we must handle this case.
> > >
> > > Hm... I'd simply disable creating any new namespaces for threads.
> > > I think other namespaces developers agree with me. Serge, Suka, Eric
> > > what do you think?
> >
> > I almost agree. sys_unshare() in a multithreaded process breaks
> > all kinds of user space libs. So you can only reasonably look at
> > the problem as what we do with linux tasks that share some things
> > and not others. The posix/opengroup notion of processes and threads
> > are a distraction.
> >
> > In this case requiring it appears that to require unsharing both
> > CLONE_SYSVSEM and CLONE_NEWIPC at the same time. (i.e. unshare
> > of CLONE_SYSVSEM should fail if CLONE_NEWIPC is not also specified).
> >
> > Then to make it work we make unshare of SYSVSEM succeed when it is
> > not shared.
> >
> > This looks like about a 5 line patch or two.
> >
> > The effect is because we don't support unsharing of SYSVSEM currently
> > we don't support a threaded process unsharing the ipc namespace.
> >
> > Eric
>
> Eric, does the following patch correctly interpret your recommendation?
>
> Pavel does it make sense to you?
>
> thanks,
> -serge
>
> >From 9c85fb3cb80cea1d888c3c253a9fb6e9bc173649 Mon Sep 17 00:00:00 2001
> From: Serge E. Hallyn <serue@us.ibm.com>
> Date: Thu, 3 Apr 2008 12:43:23 -0700
> Subject: [PATCH 1/1] ipc namespaces: fix svsem unsharing issue
>
> Refuse to unshare an ipcns if the semundo is shared and we
> are not requesting a new SYSVSEM
>
> Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
> ---
> ipc/namespace.c | 10 ++++++++++
> 1 files changed, 10 insertions(+), 0 deletions(-)
>
> diff --git a/ipc/namespace.c b/ipc/namespace.c
> index 9171d94..9044505 100644
> --- a/ipc/namespace.c
> +++ b/ipc/namespace.c
> @@ -48,6 +48,16 @@ struct ipc_namespace *copy_ipcs(unsigned long flags, struct ipc_namespace *ns)
> if (!(flags & CLONE_NEWIPC))
> return ns;
>
> + if (!(flags & CLONE_SYSVSEM)) {
