linux-kernel - Re: [PATCH] pid_ns: support pidns switching between sibling

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20231011102231.5464c68ddd9e89deb9aa0ca9@linux-foundation.org>
Date:   Wed, 11 Oct 2023 10:22:31 -0700
From:   Andrew Morton <akpm@...ux-foundation.org>
To:     Yunhui Cui <cuiyunhui@...edance.com>
Cc:     keescook@...omium.org, brauner@...nel.org, jeffxu@...gle.com,
        frederic@...nel.org, mcgrof@...nel.org, cyphar@...har.com,
        rongtao@...tc.cn, linux-kernel@...r.kernel.org,
        "Eric W. Biederman" <ebiederm@...ssion.com>
Subject: Re: [PATCH] pid_ns: support pidns switching between sibling

On Wed, 11 Oct 2023 14:54:46 +0800 Yunhui Cui <cuiyunhui@...edance.com> wrote:

> In the scenario of container acceleration, when a target pstree
> is cloned from a temp pstree, we hope that the cloned process is
> inherently in the target's pid namespace.
> Examples of what we expected:
> 
> /* switch to target ns first. */
> setns(target_ns, CLONE_NEWPID);
> if(!fork()) {
> /* Child */
> ...
> }
> /* switch back */
> setns(temp_ns, CLONE_NEWPID);
> 
> However, it is limited by the existing implementation, CAP_SYS_ADMIN
> has been checked in pidns_install(), so remove the limitation that only
> by traversing parent can switch pidns.
> 

(cc Eric)

> --- a/kernel/pid_namespace.c
> +++ b/kernel/pid_namespace.c
> @@ -389,7 +389,7 @@ static int pidns_install(struct nsset *nsset, struct ns_common *ns)
>  {
>  	struct nsproxy *nsproxy = nsset->nsproxy;
>  	struct pid_namespace *active = task_active_pid_ns(current);
> -	struct pid_namespace *ancestor, *new = to_pid_ns(ns);
> +	struct pid_namespace *new = to_pid_ns(ns);
>  
>  	if (!ns_capable(new->user_ns, CAP_SYS_ADMIN) ||
>  	    !ns_capable(nsset->cred->user_ns, CAP_SYS_ADMIN))
> @@ -406,12 +406,6 @@ static int pidns_install(struct nsset *nsset, struct ns_common *ns)
>  	if (new->level < active->level)
>  		return -EINVAL;
>  
> -	ancestor = new;
> -	while (ancestor->level > active->level)
> -		ancestor = ancestor->parent;
> -	if (ancestor != active)
> -		return -EINVAL;
> -
>  	put_pid_ns(nsproxy->pid_ns_for_children);
>  	nsproxy->pid_ns_for_children = get_pid_ns(new);
>  	return 0;
> -- 
> 2.20.1