From nobody Fri Jan 2 13:52:28 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F3B96CD98C7 for ; Wed, 11 Oct 2023 06:55:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344178AbjJKGzb (ORCPT ); Wed, 11 Oct 2023 02:55:31 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37870 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229497AbjJKGz3 (ORCPT ); Wed, 11 Oct 2023 02:55:29 -0400 Received: from mail-pl1-x635.google.com (mail-pl1-x635.google.com [IPv6:2607:f8b0:4864:20::635]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5781B93 for ; Tue, 10 Oct 2023 23:55:28 -0700 (PDT) Received: by mail-pl1-x635.google.com with SMTP id d9443c01a7336-1c87a85332bso54513865ad.2 for ; Tue, 10 Oct 2023 23:55:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bytedance.com; s=google; t=1697007328; x=1697612128; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:from:to:cc:subject:date:message-id:reply-to; bh=ykcEFA0ijkjBw3h+Q6uTEQDITJX5wqqBCPD/TQXajLU=; b=JEGGDHUJGMH5VVHqt7OenbSyE1T7GEWQD7o4I58dzPNPMai47+31zh7VQLYmCSAsZS gXS81dZVG8EyGBZTDtguCYJ51ORs5j8ehVN9f8RDtBMhIneBLOU3tpobrKqd17rEe0iQ uYYSiO46M1NfoVUeUh8hO4y5joE0dwzR8sZKt5fmjUbcRtUpmox7lKTjOka7hvhrdV1e o1ldor38kOCZ8ZMxRst7x34xJStIuJGEAzNS3oFqgVvudW93viOmjyJXP2K21dZSQ/9f e3qOob87p2Uf6zjJdnW5yQngTxetlouIPePD8wbk/EwD2pVdLsYjWg3fYpXvE/BEsMgY d/BA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1697007328; x=1697612128; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=ykcEFA0ijkjBw3h+Q6uTEQDITJX5wqqBCPD/TQXajLU=; b=sebvvqGc4VB6VJkKtc/V20tcwTnRCCP3UIQNEgPtwSngh7KGSj8x21cVFIvFRUvyzg JbF1m9ghNL9TsHobv2yfz7eigJHgirwF8kbNCcc6ZceK8O9WFZgq1AqnOKo85vLKe0Ai LW5TSbXUl0XAHPj2pogToaWrrUtV2qF0d2mkDf76+yXJf61M5Ie1ifA6Di1vb5/4YbAK 1QKf0s+Eha1Fh5/aUwxfV4hZ8vcQNZHDiCjjPD0ew1DjwHp51lFovV6FWdSEOs7SvVp2 /Qnl2RIXQAXpgoGVUKczlJlI0kD7d7Tkzs2GM0Ae9PeQS1hHFAQjy2i/3b52c2HJ9qqD ZQKA== X-Gm-Message-State: AOJu0Yy/cz4v6ULLpnD2L2ouZCdhm7UWbljI2hWyiYmv8t727Es/JHyt pNXvtOa74F5aBaU587KZ0f5zkQ== X-Google-Smtp-Source: AGHT+IFtVfqEL3cXupeR7zWbExjmzoKlxynYw+PKgUbPODHu4M5raoe1y9iuzkIlnRn5PIPBoTMuAw== X-Received: by 2002:a05:6a20:938b:b0:15a:2c0b:6c73 with SMTP id x11-20020a056a20938b00b0015a2c0b6c73mr25644714pzh.12.1697007327744; Tue, 10 Oct 2023 23:55:27 -0700 (PDT) Received: from L6YN4KR4K9.bytedance.net ([61.213.176.10]) by smtp.gmail.com with ESMTPSA id n14-20020a170902d2ce00b001bf52834696sm13010464plc.207.2023.10.10.23.55.24 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Tue, 10 Oct 2023 23:55:27 -0700 (PDT) From: Yunhui Cui To: akpm@linux-foundation.org, keescook@chromium.org, brauner@kernel.org, jeffxu@google.com, frederic@kernel.org, mcgrof@kernel.org, cyphar@cyphar.com, cuiyunhui@bytedance.com, rongtao@cestc.cn, linux-kernel@vger.kernel.org Subject: [PATCH] pid_ns: support pidns switching between sibling Date: Wed, 11 Oct 2023 14:54:46 +0800 Message-Id: <20231011065446.53034-1-cuiyunhui@bytedance.com> X-Mailer: git-send-email 2.39.2 (Apple Git-143) MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" In the scenario of container acceleration, when a target pstree is cloned from a temp pstree, we hope that the cloned process is inherently in the target's pid namespace. Examples of what we expected: /* switch to target ns first. */ setns(target_ns, CLONE_NEWPID); if(!fork()) { /* Child */ ... } /* switch back */ setns(temp_ns, CLONE_NEWPID); However, it is limited by the existing implementation, CAP_SYS_ADMIN has been checked in pidns_install(), so remove the limitation that only by traversing parent can switch pidns. Signed-off-by: Yunhui Cui --- kernel/pid_namespace.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c index 3028b2218aa4..774db1f268f1 100644 --- a/kernel/pid_namespace.c +++ b/kernel/pid_namespace.c @@ -389,7 +389,7 @@ static int pidns_install(struct nsset *nsset, struct ns= _common *ns) { struct nsproxy *nsproxy =3D nsset->nsproxy; struct pid_namespace *active =3D task_active_pid_ns(current); - struct pid_namespace *ancestor, *new =3D to_pid_ns(ns); + struct pid_namespace *new =3D to_pid_ns(ns); =20 if (!ns_capable(new->user_ns, CAP_SYS_ADMIN) || !ns_capable(nsset->cred->user_ns, CAP_SYS_ADMIN)) @@ -406,12 +406,6 @@ static int pidns_install(struct nsset *nsset, struct n= s_common *ns) if (new->level < active->level) return -EINVAL; =20 - ancestor =3D new; - while (ancestor->level > active->level) - ancestor =3D ancestor->parent; - if (ancestor !=3D active) - return -EINVAL; - put_pid_ns(nsproxy->pid_ns_for_children); nsproxy->pid_ns_for_children =3D get_pid_ns(new); return 0; --=20 2.20.1