Support mount, uts and ipc namespaces in the host

[devimc]

Unlike other runtimes, we have several components like qemu, kata-shim and
kata-proxy that should be placed in new namespace to improve the isolation and
security. The problem is that we need persistent namespaces and in the case of
the mount namespace (aka headache namespace ;)), it MUST BE created before
starting golang execution and in a new mount point with a propagation different
to shared, even worse, to make it persistent the new namespace
(/proc/PID/ns/mnt) MUST be 'bind mounted' by a process that doesn't know of the
existence of it. To get more information about this, see
github.com/karelzak/util-linux/commit/c84f2590dfdb8570beeb731e0105f8fe597443d1

With these new functions now is possible to join, create, remove and make
persistent namespaces. Next diagram can help us to understand how it works.

 ============================================================================
| Host's namespace                                    | New namespace!       |
|                                                     |                      |
| ---------------------------------------------------------------------------|
| C (no threads, no goroutines, NO GOLANG!)           |                      |
|                                                     |                      |
|  ---------   ---------------                        |                      |
| | Runtime |-|listen children|--|fork-setns-unshare|-|-------.              |
|  ---------   ---------------\                       |       |              |
|      |               |       \                      |       |              |
|    fork              |        Wait children &       |       |              |
|      |               |             exit             |       |              |
|----------------------------------------------------------------------------|
| Golang               |                              |       |              |
|      |        join,create,make,remove               |       |              |
|  ---------    persistent namespace                  |   ---------          |
| | Runtime |          |                              |  | Runtime |         |
|  ---------        --------                          |   ---------          |
|      |           |-Create |                         |       |              |
|  parse jsons     |-Start  |                         | Create,start,etc.    |
|  and cmdline     |-Delete |                         |   Containers         |
|       \          |-etc    |                         |       |              |
|        \         |--------                          |      exit            |
|         --subcmd-'                                  |                      |
|          \                                          |                      |
|           - exit                                    |                      |
============================================================================

fixes #160

Depends-on: github.com/kata-containers/tests#946

Signed-off-by: Julio Montes julio.montes@intel.com

[devimc]

/test

[devimc]

/test

[sboeuf]

@devimc thanks for the PR, but please be more verbose about the problem statement, and the reasons behind the choices you made. It is a pretty huge PR affecting main components, and it needs to be clear about the why and how.

[devimc]

@sboeuf sure, I still need to write a document

[devimc]

/test

[jshachm]

waiting for the doc~ @devimc and maybe we need to take mount ns leak into consideration

[devimc]

/test

[devimc]

/test

[devimc]

/test

[devimc]

/test

[devimc]

/test

[devimc]

@kata-containers/runtime @bergwolf @gnawux @sboeuf please take a look

[amshinde]

@devimc This needs a rebase.
We talked about having this in the architecture committee, I know I missed the last one. Was this discussed at all?

[raravena80]

@devimc any updates?

[devimc]

@raravena80 ehmm nop, I'd like to present this in the kata arch meeting

[jodh-intel]

Hi @devimc - Thanks for raising! As @sboeuf has noted, this is a complex one. It does kind of feel like this issue should be handled by fixing golang rather than us having to jump through "hoops of fire" as it were ;) On that topic, is anyone aware of a golang github issue regarding the namespace issues? I took a quick look but didn't find anything useful (ironically, searching on google lead me back to the Kata github project! ;)

Awesome ASCII art btw, but it would be helpful if you could provide a step-by-step explanation of how this works to allow us all to "digest" this PR more quickly.

[caoruidong]

What issue? The namespace problem fixed in golang 1.10? golang/go#20676 #148

[jodh-intel]

@caoruidong - I was referring to @sboeuf's comment:

It's very interesting and complex as Golang is really not friendly with namespaces.

[devimc]

@jodh-intel golang/go#8676 Status changed to WontFix

[jodh-intel]

@devimc - This has been open for a while now (and the branch is now conflicted).

I think there is a general feeling that although this PR solves a problem, it introduces more complexity that we are comfortable with, unless there is a very good reason for it. It also introduces C code. I understand why that is, but again, I think we'd rather not use C unless there is a super-compelling reason for it due to the potential security implications. It would also require us to setup new static analysis, etc, etc.

Hence, please could you / @amshinde provide further details on why we need this with, ideally with some examples. Trying to trace back through the issues leads to the initial issue... containing no details :-((

I think you did present this at the Architecture Committee meeting? Please could you add details here of what the feedback was. If there wasn't any, or wasn't enough, I think it might be worth you raising this topic again in the AC meeting. Now that folk have had time to consider the impact of adding this change we might get more feedback.