Unverified Commit 7df87820 authored by Aleksa Sarai's avatar Aleksa Sarai Committed by Christian Brauner
Browse files

pidns: move is-ancestor logic to helper 



This check will be needed in later patches, and there's no point
open-coding it each time.

Signed-off-by: default avatarAleksa Sarai <cyphar@cyphar.com>
Link: https://lore.kernel.org/20250805-procfs-pidns-api-v4-1-705f984940e7@cyphar.com


Signed-off-by: default avatarChristian Brauner <brauner@kernel.org>
parent 998541db

include/linux/pid_namespace.h

+9 −0
Original line number Diff line number Diff line
@@ -84,6 +84,9 @@ extern void zap_pid_ns_processes(struct pid_namespace *pid_ns); 
extern int reboot_pid_ns(struct pid_namespace *pid_ns, int cmd);

extern void put_pid_ns(struct pid_namespace *ns);



extern bool pidns_is_ancestor(struct pid_namespace *child,

			      struct pid_namespace *ancestor);



#else /* !CONFIG_PID_NS */

#include <linux/err.h>
@@ -118,6 +121,12 @@ static inline int reboot_pid_ns(struct pid_namespace *pid_ns, int cmd) 
{

	return 0;

}



static inline bool pidns_is_ancestor(struct pid_namespace *child,

				     struct pid_namespace *ancestor)

{

	return false;

}

#endif /* CONFIG_PID_NS */



extern struct pid_namespace *task_active_pid_ns(struct task_struct *tsk);

kernel/pid_namespace.c

+14 −8
Original line number Diff line number Diff line
@@ -390,11 +390,23 @@ static void pidns_put(struct ns_common *ns) 
	put_pid_ns(to_pid_ns(ns));

}



bool pidns_is_ancestor(struct pid_namespace *child,

		       struct pid_namespace *ancestor)

{

	struct pid_namespace *ns;



	if (child->level < ancestor->level)

		return false;

	for (ns = child; ns->level > ancestor->level; ns = ns->parent)

		;

	return ns == ancestor;

}



static int pidns_install(struct nsset *nsset, struct ns_common *ns)

{

	struct nsproxy *nsproxy = nsset->nsproxy;

	struct pid_namespace *active = task_active_pid_ns(current);

	struct pid_namespace *ancestor, *new = to_pid_ns(ns);

	struct pid_namespace *new = to_pid_ns(ns);



	if (!ns_capable(new->user_ns, CAP_SYS_ADMIN) ||

	    !ns_capable(nsset->cred->user_ns, CAP_SYS_ADMIN))
@@ -408,13 +420,7 @@ static int pidns_install(struct nsset *nsset, struct ns_common *ns) 
	 * this maintains the property that processes and their

	 * children can not escape their current pid namespace.

	 */

	if (new->level < active->level)

		return -EINVAL;



	ancestor = new;

	while (ancestor->level > active->level)

		ancestor = ancestor->parent;

	if (ancestor != active)

	if (!pidns_is_ancestor(new, active))

		return -EINVAL;



	put_pid_ns(nsproxy->pid_ns_for_children);