On Wed, Apr 17, 2019 at 02:03:16PM +0200, Enrico Weigelt, metux IT consult wrote: > On 16.04.19 23:31, Andy Lutomirski wrote: > > >> How exactly would the pidfd improve this scenario ? > >> IMHO, would just need to pass the inherited fd's to that daemon (eg. > >> via unix socket) which then sets them up in the new child process. > > > > It makes it easier to wait until the privileged program exits. > > Without pidfd, you can't just wait(2) because the program that gets > > spawned isn't a child. > > Ah, that is a cool thing ! > I suppose that also works across namespaces ? Yes, it should. If you hand off the pidfd to another pidns (e.g. via SCM credentials) for example. > > What other things can be done via pidfd ? Very basic things right now and until CLONE_PIDFD is accepted (possibly for 5.2) we won't enable any more features. I'm not a fan of wild speculations and grand schemes that then don't come to fruition. :) Right now it's about focussing on somewhat cleanly covering the basics. Coming to a consensus there was hard enough. We have no intention in making this more complex right now as it needs to be. Christian
