Linux kernel namespace: erinevus redaktsioonide vahel

Allikas: Imre kasutab arvutit
Mine navigeerimisribaleMine otsikasti
167. rida: 167. rida:
 
</pre>
  
</pre>
   
  +
siis postgresql protsessid saavad omale isikliku namespace'i
−
siis
  
   
 
<pre>
  
<pre>

Redaktsioon: 14. aprill 2026, kell 20:54

Sissejuhatus

TODO

Tööpõhimõte

Namespace dimensioonid, 2026 aasta alguses 8

  • mnt (Mount): Filesystems
  • uts: Hostname/Domain
  • ipc: Shared memory/Message queues
  • pid: Process numbering
  • net: Network stack
  • user: UID/GID mapping (The "Key" to rootless)
  • cgroup: Control group hierarchy
  • time: System clock offset (the "newest" major one)

Väited

  • süsteemi käivitamisel moodustatakse automaatselt esimene namespace (root/initial/global namespace)
  • namespace ja kasutaja ei käi koos, nt global namespace kõik protsessid

Misc

kasutaja@ph-minio-01:~$ unshare --user --net --map-root-user /bin/bash

root@ph-minio-01:~# ip addr
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00

root@ph-minio-01:~# ip addr add 127.0.0.1 dev lo
root@ph-minio-01:~# ip link set up dev lo

root@ph-minio-01:~# ping -c 2 127.0.0.1
PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.
64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.016 ms
64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.020 ms

--- 127.0.0.1 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1023ms
rtt min/avg/max/mdev = 0.016/0.018/0.020/0.002 ms

ning 

root@ph-minio-01:~# lsns -n | grep kasutaja
4026532406 user       1  5124 kasutaja         /bin/bash
4026532407 net        1  5124 kasutaja         /bin/bash

root@ph-minio-01:~# lsns 4026532406
  PID  PPID USER     COMMAND
 5124  4954 kasutaja /bin/bash

root@ph-minio-01:~# lsns 4026532407
  PID  PPID USER     COMMAND
 5124  4954 kasutaja /bin/bash

Piiratud keskkonna moodustamine 

kasutaja@ph-minio-01:~$ unshare --user --net --pid --map-root-user --mount --fork /bin/bash

root@ph-minio-01:~# mount --make-rprivate /

root@ph-minio-01:~# mount -t proc proc /proc

root@ph-minio-01:~# mount -t sysfs sysfs /sys

root@ph-minio-01:~# mkdir /tmp/empty

root@ph-minio-01:~# mount --bind /tmp/empty /sys/bus/pci

Tulemusena 

root@ph-minio-01:~# lspci
lspci: Cannot open /sys/bus/pci/devices

root@ph-minio-01:~# /usr/sbin/driverctl list-devices
driverctl: No overridable devices found. Kernel too old?

root@ph-minio-01:~# dmesg
dmesg: read kernel buffer failed: Operation not permitted

root@ph-minio-01:~# netstat -ant
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State

ning lsns vaatest 

kasutaja@ph-minio-01:~$ lsns
        NS TYPE   NPROCS   PID USER     COMMAND
...
4026532406 user        2  6065 kasutaja ├─unshare --user --net --pid --map-root-user --mount --fork /bin/bash
4026532407 mnt         2  6065 kasutaja ├─unshare --user --net --pid --map-root-user --mount --fork /bin/bash
4026532408 pid         1  6066 kasutaja │ └─/bin/bash
4026532409 net         2  6065 kasutaja └─unshare --user --net --pid --map-root-user --mount --fork /bin/bash

unshare väljumisest sobib öelda exit 

root@ph-minio-01:~# exit
kasutaja@ph-minio-01:~$

systemd varjab namespace abil protsessi eest ära osa failisüsteemist 

root@dh-minio-01:~# lsns --tree=owner
NS           TYPE   NPROCS   PID USER             COMMAND
4026531837   user      110     1 root             /sbin/init
├─4026531834 time      110     1 root             /sbin/init
├─4026531835 cgroup    110     1 root             /sbin/init
├─4026531836 pid       110     1 root             /sbin/init
├─4026531838 uts       106     1 root             /sbin/init
├─4026531839 ipc       110     1 root             /sbin/init
├─4026531840 net       110     1 root             /sbin/init
├─4026531841 mnt       105     1 root             /sbin/init
├─4026531862 mnt         1    32 root             kdevtmpfs
├─4026532333 mnt         1   322 systemd-timesync /usr/lib/systemd/systemd-timesyncd
├─4026532336 mnt         1   353 root             /usr/lib/systemd/systemd-udevd
├─4026532337 uts         1   322 systemd-timesync /usr/lib/systemd/systemd-timesyncd
├─4026532338 uts         1   353 root             /usr/lib/systemd/systemd-udevd
├─4026532406 mnt         1 11405 root             /usr/sbin/rsyslogd -n -iNONE
├─4026532407 uts         1 11405 root             /usr/sbin/rsyslogd -n -iNONE
├─4026532461 uts         1   653 root             /usr/lib/systemd/systemd-logind
├─4026532468 mnt         1   653 root             /usr/lib/systemd/systemd-logind

root@dh-minio-01:~# nsenter -m -t 322 findmnt | grep inacc
TARGET                    SOURCE                              FSTYPE      OPTIONS

├─/home                   tmpfs[/systemd/inaccessible/dir]    tmpfs       ro,nosuid,nodev,noexec,relatime,size=605312k,mode=755,inode64
│ ├─/proc/kallsyms        tmpfs[/systemd/inaccessible/reg]    tmpfs       ro,nosuid,nodev,noexec,relatime,size=605312k,mode=755,inode64
│ ├─/proc/kcore           tmpfs[/systemd/inaccessible/reg]    tmpfs       ro,nosuid,nodev,noexec,relatime,size=605312k,mode=755,inode64
│ ├─/proc/kmsg            tmpfs[/systemd/inaccessible/reg]    tmpfs       ro,nosuid,nodev,noexec,relatime,size=605312k,mode=755,inode64
│ ├─/run/credentials      tmpfs[/systemd/inaccessible/dir]    tmpfs       ro,nosuid,nodev,noexec,relatime,size=605312k,mode=755,inode64
├─/root                   tmpfs[/systemd/inaccessible/dir]    tmpfs       ro,nosuid,nodev,noexec,relatime,size=605312k,mode=755,inode64
├─/usr/lib/modules        tmpfs[/systemd/inaccessible/dir]    tmpfs       ro,nosuid,nodev,noexec,relatime,size=605312k,mode=755,inode64

root@dh-minio-01:~# systemctl show systemd-timesyncd | grep ^Prote
ProtectClock=no
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
ProtectControlGroupsEx=yes
ProtectHome=yes
ProtectSystem=strict
ProtectProc=invisible
ProtectHostname=yes

Kui nt vaikimisi midagi mitte varjavale postgresqli serviceile lisada 

root@dh-minio-01:~# systemctl edit postgresql@17-main

[Service]
ProtectKernelModules=yes

siis postgresql protsessid saavad omale isikliku namespace'i 

root@dh-minio-01:~# lsns --tree=owner
NS           TYPE   NPROCS    PID USER             COMMAND
4026531837   user      115      1 root             /sbin/init
├─4026531834 time      115      1 root             /sbin/init
├─4026531835 cgroup    115      1 root             /sbin/init
├─4026531836 pid       115      1 root             /sbin/init
├─4026531838 uts       111      1 root             /sbin/init
├─4026531839 ipc       115      1 root             /sbin/init
├─4026531840 net       115      1 root             /sbin/init
├─4026531841 mnt       104      1 root             /sbin/init
├─4026531862 mnt         1     32 root             kdevtmpfs
├─4026532333 mnt         1    322 systemd-timesync /usr/lib/systemd/systemd-timesyncd
├─4026532336 mnt         1    353 root             /usr/lib/systemd/systemd-udevd
├─4026532337 uts         1    322 systemd-timesync /usr/lib/systemd/systemd-timesyncd
├─4026532338 uts         1    353 root             /usr/lib/systemd/systemd-udevd
├─4026532406 mnt         1  11405 root             /usr/sbin/rsyslogd -n -iNONE
├─4026532407 uts         1  11405 root             /usr/sbin/rsyslogd -n -iNONE
├─4026532408 mnt         6 146129 postgres         /usr/lib/postgresql/17/bin/postgres -D /var/lib/postgresql/17/main -c config_file=/etc/postgresql/17/main/postgresql.conf
├─4026532461 uts         1    653 root             /usr/lib/systemd/systemd-logind
├─4026532468 mnt         1    653 root             /usr/lib/systemd/systemd-logind

Kasulikud lisamaterjalid

  • TODO
Pärit leheküljelt "https://www.auul.pri.ee/wiki/index.php?title=Linux_kernel_namespace&oldid=3207"