Phantom Jails

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Rumors went around and tales were told about jails magically booing
around in prison list, even after they deceased.

Most people consider this a rather aesthetical issue, however if you run
your jails from directories that need to be unmounted (e.g. from
md-images, on external drives, from gbde or geli images) those phantom
jails become rather annoying, since you cannot umount their roots.

Investigations have shown, that

1) sockets hold a lock on (increase reference counter in) the ucred
structure of the calling process
2) This ucred structure in turn keeps a lock on (increases reference
counter in) the prison struct representing the jail this process belongs to
3) The prison struct in turn keeps a handle to jails root directory.

If a process holding a tcp connection is killed, the connection is being
inherited by the kernel. It waits there for tcp tear down or tcp time
out to occur. Only then socket's lock on ucred is released, which
releases ucreds lock on prison struct (thus terminating phantom jails)
which may, if it is the last ucred referencing the prison, release the
prison and its handle to the root directory (solving my un-umount-able
images).

There were kinds of phantom jails being sighted, that did not vanish
after tcp timeout, that might be deadlocked by open files or mmaped
regions. However the above case happens regularly with my mail server
jail that holds hundreds of imap-connections, one disconnected dsl-user
can prevent tcp tear down to happen successfully thus forcing me to
force umount the mail server.

My suggestion would be (I will provide a patch, if discussion produces
no major disagreement) to release ucred structs held by sockets as soon
as the process dies. They are being used for accounting purposes only,
anyway. The same may apply to the other types of phantom jails, as well.
I could not create those deliberately and therefore can not exactly spot
the proper location to fix.

Comments?

erdgeist

P.S.: if you want to reproduce a phantom jail try the following:
1) create and start a jail
2) Start a ssh/web/whatever server within the jail
3) Connect to that server from the host system.
4) Keep this connection open while you kill the jail
5) Do a 'jls' and compare its output to "ps axuu | grep J"
6) Kill the process that connected to the service.
7) Do a 'jls' again.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (Darwin)

iD8DBQFFXSp5ImmQdUyYEgkRAtOAAJ4iSzyu2LOf+RBNArvYAk1Tv8cssACfRxJa
12OGEwWugcIDhlGGTHJrz0o=
=gXK8
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-hackers@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-hackers
To unsubscribe, send any mail to "freebsd-hackers-unsubscribe@xxxxxxxxxxx"

Relevant Pages

  • 1 in 136 U.S. Residents Behind Bars By
    ... The holier-than-thou rollers are cheering "crime ... WASHINGTON - Prisons and jails added more than 1,000 inmates each week ... Of particular note was the gain of 33,539 inmates in jails, the largest ... populations in prison or jail. ...
    (alt.politics)
  • American prisoners hit world record
    ... WASHINGTON -- Prisons and jails added more than 1,000 inmates each ... growing prison inmate population in this country. ... Mauer also criticized sentencing guidelines, ...
    (soc.culture.china)
  • Re: Peoples Camping on the Upswing, Says Cuban President
    ... WASHINGTON - Prisons and jails added more than 1,000 inmates each week ... Of particular note was the gain of 33,539 inmates in jails, the largest ... populations in prison or jail. ... Mauer also criticized sentencing guidelines, ...
    (soc.culture.cuba)
  • 1 in 136 U.S. Residents in Prison
    ... in 136 U.S. Residents Behind Bars ... Prisons and jails added more than 1,000 inmates each week for a year, ... Of particular note was the gain of 33,539 inmates in jails, the largest ... populations in prison or jail. ...
    (soc.culture.indian)
  • Re: Idea about "skeleton jail"
    ... I would definitely like to see the jails extended in a way that would ... each prison can have CPU/MEM/#PROCS limits in ... response. ... able to assist with any problems with the patch, ...
    (freebsd-hackers)