From mboxrd@z Thu Jan  1 00:00:00 1970
Message-ID: <98A462DFDA6CBC03654DC58C6B063013@musolino.id.au>
To: 9fans@9fans.net
From: Alex Musolino <alex@musolino.id.au>
Date: Wed, 25 Oct 2017 01:21:05 +1100
In-Reply-To: 599371FE-4267-42E9-9493-BD0AB8659F98@gmail.com
MIME-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Subject: Re: [9fans] Backgrounding a task
Topicbox-Message-UUID: c3fb2c28-ead9-11e9-9d60-3106f5b1d025

> The namespace join facility looks interesting. Do you have a patch
> somewhere for it?

I'll see what I can dig up though it wouldn't tbe erribly difficult to
reimplement.  You basically just need to modify the pgrp pointer of
the proc, adjusting ref counts as required.

>> Of course, a lot of the isolation that per-process namespaces give
>> you is suddenly undone by the introduction of this facility.
>
> I'm not sure if the lack of isolation is any different than what can
> be done with a child process that shares the namespace.  Is there a
> particular case that you are thinking?

Creating a child process is something that a process explicitly
controls and the RFNOTEG flag of rfork(2) allows a process to control
whether or not it shares its namespace with its children.  Allowing
other, unrelated processes to fiddle with your namespace is quite
different.

Think about multiple processes owned by multiple users running on a
cpu server.  Which processes should be allowed to join which
namespaces?

Perhaps allowing only the hostowner to join namespaces for debugging
and administration purposes would be acceptable.

>> At this point I'm not entirely convinced that it's worth the
>> trouble.
>=20
> I think that it can be depending on how much time you have spent
> building up a namespace for a process.  Perhaps I have spent hours
> working on something slowly customizing the namespace mounting and
> binding things.  If I end up running a long running command that
> blocks and I want to work in parallel with it then I must remember
> everything that I have done and repeat in a new window.  It seems
> like something the computer should do for me or at least help me to do
> it.

This seems a contrived example.  Would you really spend HOURS working
on setting up a namespace by hand?  Surely you would instead be
working on a script that builds the namespace for you; make the
computer do the work.  Then when you mess up, you can modify the
script, create a new window, and try again.

One more thing to consider is the #=CF=83 device in 9front which seems to
address some of the problems that you might otherwise use nsjoin to
solve.

--
Cheers,
Alex Musolino