From patchwork Wed Oct 11 06:54:46 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: yunhui cui X-Patchwork-Id: 151163 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:612c:2908:b0:403:3b70:6f57 with SMTP id ib8csp347996vqb; Tue, 10 Oct 2023 23:55:50 -0700 (PDT) X-Google-Smtp-Source: AGHT+IF8UPa67pVnONTCIgEPMVwSFQXJfbPq1/1J78c3K6+NpBfZw/EqMG0rFbOtL9uSnaHHjDHt X-Received: by 2002:a05:6870:b4a5:b0:1a7:f79c:2fbc with SMTP id y37-20020a056870b4a500b001a7f79c2fbcmr23882042oap.0.1697007350682; Tue, 10 Oct 2023 23:55:50 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1697007350; cv=none; d=google.com; s=arc-20160816; b=Oz3mILBOUfldjXbGCg7rlJWexQc6negBDkCDwaqJR/tedi6aOos8N6KfF9oNmvSp3y alacRseuouoay3V2CYuYcQjgLcPxqlouvFxgRjColnBOGnfi6z2cCIVlhilxHMYySnp4 7VxJRZSVJsnhlf5rxiax/d9F6SeCt+Pgx8/hDtYN2Zea+iBojugAjCmDrM164Os54WOt K4O1/jNzTE3BVqph7mQxM574unL/FdLsplzNwa3cJTSvScHvi/7oeSqfM5u/H12cPzhY 52VAxklz1nGmuDSJIWDwQElwdpfwG13+7y6zVQbDbbAQWJvVd1/7DfIM5+kwa15XBrIc R/Pg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:to:from:dkim-signature; bh=ykcEFA0ijkjBw3h+Q6uTEQDITJX5wqqBCPD/TQXajLU=; fh=NPlRuEA1XmcFgtad3eVy6A24JPJh4fKkB+tfymfWzXg=; b=xGUXymbcaed66OiBnYdpigpRhdxJKTMSaMLNe9EC8jUbssGQ3Rj9XldPvpdNPhx59q Eyerpk0PYyT/6FmBhxTUP0jI0Pn5YCPKfd6SX2PMRFg5/6BSObURSh5yeOm8Vc/kxfSO h+yubQ5x6ggr4FSb86u9awzQH7ppFS5Jp1SwtunAb6w+HB8XBvJNEY7EsoIqjmVduG+Y qjw7ORvozkkxR229kd814qxrcUL0RIj5NfB9vM4BHjVVi/fWLfLDFGR8Hp20VGTffKUF vsJRMn5R3SXafihoOXyorQduVkgZez3+wOinMqRF6pOj2DAly3IHjkgOzSuqvw2Z1i5I QZZw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@bytedance.com header.s=google header.b=JEGGDHUJ; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:4 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=bytedance.com Received: from howler.vger.email (howler.vger.email. [2620:137:e000::3:4]) by mx.google.com with ESMTPS id p21-20020a637415000000b0058ae63187e5si9689344pgc.830.2023.10.10.23.55.50 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 10 Oct 2023 23:55:50 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:4 as permitted sender) client-ip=2620:137:e000::3:4; Authentication-Results: mx.google.com; dkim=pass header.i=@bytedance.com header.s=google header.b=JEGGDHUJ; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:4 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=bytedance.com Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0]) by howler.vger.email (Postfix) with ESMTP id 7D07D8027DDB; Tue, 10 Oct 2023 23:55:48 -0700 (PDT) X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.10 at howler.vger.email Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343968AbjJKGzb (ORCPT + 19 others); Wed, 11 Oct 2023 02:55:31 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37870 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229497AbjJKGz3 (ORCPT ); Wed, 11 Oct 2023 02:55:29 -0400 Received: from mail-pl1-x635.google.com (mail-pl1-x635.google.com [IPv6:2607:f8b0:4864:20::635]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5781B93 for ; Tue, 10 Oct 2023 23:55:28 -0700 (PDT) Received: by mail-pl1-x635.google.com with SMTP id d9443c01a7336-1c87a85332bso54513865ad.2 for ; Tue, 10 Oct 2023 23:55:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bytedance.com; s=google; t=1697007328; x=1697612128; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:from:to:cc:subject:date:message-id:reply-to; bh=ykcEFA0ijkjBw3h+Q6uTEQDITJX5wqqBCPD/TQXajLU=; b=JEGGDHUJGMH5VVHqt7OenbSyE1T7GEWQD7o4I58dzPNPMai47+31zh7VQLYmCSAsZS gXS81dZVG8EyGBZTDtguCYJ51ORs5j8ehVN9f8RDtBMhIneBLOU3tpobrKqd17rEe0iQ uYYSiO46M1NfoVUeUh8hO4y5joE0dwzR8sZKt5fmjUbcRtUpmox7lKTjOka7hvhrdV1e o1ldor38kOCZ8ZMxRst7x34xJStIuJGEAzNS3oFqgVvudW93viOmjyJXP2K21dZSQ/9f e3qOob87p2Uf6zjJdnW5yQngTxetlouIPePD8wbk/EwD2pVdLsYjWg3fYpXvE/BEsMgY d/BA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1697007328; x=1697612128; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=ykcEFA0ijkjBw3h+Q6uTEQDITJX5wqqBCPD/TQXajLU=; b=sebvvqGc4VB6VJkKtc/V20tcwTnRCCP3UIQNEgPtwSngh7KGSj8x21cVFIvFRUvyzg JbF1m9ghNL9TsHobv2yfz7eigJHgirwF8kbNCcc6ZceK8O9WFZgq1AqnOKo85vLKe0Ai LW5TSbXUl0XAHPj2pogToaWrrUtV2qF0d2mkDf76+yXJf61M5Ie1ifA6Di1vb5/4YbAK 1QKf0s+Eha1Fh5/aUwxfV4hZ8vcQNZHDiCjjPD0ew1DjwHp51lFovV6FWdSEOs7SvVp2 /Qnl2RIXQAXpgoGVUKczlJlI0kD7d7Tkzs2GM0Ae9PeQS1hHFAQjy2i/3b52c2HJ9qqD ZQKA== X-Gm-Message-State: AOJu0Yy/cz4v6ULLpnD2L2ouZCdhm7UWbljI2hWyiYmv8t727Es/JHyt pNXvtOa74F5aBaU587KZ0f5zkQ== X-Received: by 2002:a05:6a20:938b:b0:15a:2c0b:6c73 with SMTP id x11-20020a056a20938b00b0015a2c0b6c73mr25644714pzh.12.1697007327744; Tue, 10 Oct 2023 23:55:27 -0700 (PDT) Received: from L6YN4KR4K9.bytedance.net ([61.213.176.10]) by smtp.gmail.com with ESMTPSA id n14-20020a170902d2ce00b001bf52834696sm13010464plc.207.2023.10.10.23.55.24 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Tue, 10 Oct 2023 23:55:27 -0700 (PDT) From: Yunhui Cui To: akpm@linux-foundation.org, keescook@chromium.org, brauner@kernel.org, jeffxu@google.com, frederic@kernel.org, mcgrof@kernel.org, cyphar@cyphar.com, cuiyunhui@bytedance.com, rongtao@cestc.cn, linux-kernel@vger.kernel.org Subject: [PATCH] pid_ns: support pidns switching between sibling Date: Wed, 11 Oct 2023 14:54:46 +0800 Message-Id: <20231011065446.53034-1-cuiyunhui@bytedance.com> X-Mailer: git-send-email 2.39.2 (Apple Git-143) MIME-Version: 1.0 X-Spam-Status: No, score=2.7 required=5.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, RCVD_IN_SBL_CSS,SPF_HELO_NONE,SPF_PASS autolearn=no autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on howler.vger.email Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (howler.vger.email [0.0.0.0]); Tue, 10 Oct 2023 23:55:48 -0700 (PDT) X-Spam-Level: ** X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1779441179702098770 X-GMAIL-MSGID: 1779441179702098770 In the scenario of container acceleration, when a target pstree is cloned from a temp pstree, we hope that the cloned process is inherently in the target's pid namespace. Examples of what we expected: /* switch to target ns first. */ setns(target_ns, CLONE_NEWPID); if(!fork()) { /* Child */ ... } /* switch back */ setns(temp_ns, CLONE_NEWPID); However, it is limited by the existing implementation, CAP_SYS_ADMIN has been checked in pidns_install(), so remove the limitation that only by traversing parent can switch pidns. Signed-off-by: Yunhui Cui --- kernel/pid_namespace.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c index 3028b2218aa4..774db1f268f1 100644 --- a/kernel/pid_namespace.c +++ b/kernel/pid_namespace.c @@ -389,7 +389,7 @@ static int pidns_install(struct nsset *nsset, struct ns_common *ns) { struct nsproxy *nsproxy = nsset->nsproxy; struct pid_namespace *active = task_active_pid_ns(current); - struct pid_namespace *ancestor, *new = to_pid_ns(ns); + struct pid_namespace *new = to_pid_ns(ns); if (!ns_capable(new->user_ns, CAP_SYS_ADMIN) || !ns_capable(nsset->cred->user_ns, CAP_SYS_ADMIN)) @@ -406,12 +406,6 @@ static int pidns_install(struct nsset *nsset, struct ns_common *ns) if (new->level < active->level) return -EINVAL; - ancestor = new; - while (ancestor->level > active->level) - ancestor = ancestor->parent; - if (ancestor != active) - return -EINVAL; - put_pid_ns(nsproxy->pid_ns_for_children); nsproxy->pid_ns_for_children = get_pid_ns(new); return 0;