Fiedler Roman wrote:
>> Von: Herbert Poetzl [mailto:firstname.lastname@example.org]
>> On Mon, Oct 13, 2014 at 11:47:48AM +0000, Fiedler Roman wrote:
>> > Hi,
>> > Thanks for your reply,
>> >> Von: Herbert Poetzl [mailto:email@example.com]
>> >> On Mon, Oct 13, 2014 at 08:52:36AM +0000, Fiedler Roman wrote:
>> >>> Hello List,
>> >>> Analyzing a problem today, It seems the the root cause is, that
>> >>> a host process ended up being the child of a guest process
>> >>> after using "vserver exec".
>> Strange indeed.
>> Do you, by any chance, know if that works with LXC?
> I've constructed a simpler testcase and ran it with vserver and LXC (I
> host/guest in the prompt for distinction):
> * vserver:
> host# socat "EXEC:/bin/sleep 1000" "EXEC:vserver somename exec /bin/sleep
So nofork here means that socat will execute it in the socat process, when
it is done setting up
the other processes. So essentially, you are telling socat to make the
first process a child of the
vserver ... exec. vserver is really not a factor here.
> So asking again for opinions:
> * Can someone give a hint, how this could happen, thus being able to
> to fix the problem for now using a workaround?
Don't tell socat to do that. Tell it to do what you want.
> * No matter if misuse or bug, should this case be prevented since it
> also cause security risks due to host/guest pidns mixup?
There is no mixup. All pids are valid in the contexts they appear. As
util-vserver is not yet using pid
namespaces, there is only one.
Received on Mon Oct 13 19:36:35 2014