On Tue, Jun 25, 2024 at 10:10:29AM GMT, Jeff Layton wrote:
> On Mon, 2024-06-24 at 11:49 -0400, Josef Bacik wrote:
> > In order to utilize the listmount() and statmount() extensions that
> > allow us to call them on different namespaces we need a way to get
> > the
> > mnt namespace id from user space. Add an ioctl to nsfs that will
> > allow
> > us to extract the mnt namespace id in order to make these new
> > extensions
> > usable.
> >
> > Signed-off-by: Josef Bacik <josef@xxxxxxxxxxxxxx>
> > ---
> > fs/nsfs.c | 14 ++++++++++++++
> > include/uapi/linux/nsfs.h | 2 ++
> > 2 files changed, 16 insertions(+)
> >
> > diff --git a/fs/nsfs.c b/fs/nsfs.c
> > index 07e22a15ef02..af352dadffe1 100644
> > --- a/fs/nsfs.c
> > +++ b/fs/nsfs.c
> > @@ -12,6 +12,7 @@
> > #include <linux/nsfs.h>
> > #include <linux/uaccess.h>
> >
> > +#include "mount.h"
> > #include "internal.h"
> >
> > static struct vfsmount *nsfs_mnt;
> > @@ -143,6 +144,19 @@ static long ns_ioctl(struct file *filp, unsigned
> > int ioctl,
> > argp = (uid_t __user *) arg;
> > uid = from_kuid_munged(current_user_ns(), user_ns-
> > >owner);
> > return put_user(uid, argp);
> > + case NS_GET_MNTNS_ID: {
> > + struct mnt_namespace *mnt_ns;
> > + __u64 __user *idp;
> > + __u64 id;
> > +
> > + if (ns->ops->type != CLONE_NEWNS)
> > + return -EINVAL;
> > +
> > + mnt_ns = container_of(ns, struct mnt_namespace, ns);
> > + idp = (__u64 __user *)arg;
> > + id = mnt_ns->seq;
> > + return put_user(id, idp);
> > + }
> > default:
> > return -ENOTTY;
> > }
> > diff --git a/include/uapi/linux/nsfs.h b/include/uapi/linux/nsfs.h
> > index a0c8552b64ee..56e8b1639b98 100644
> > --- a/include/uapi/linux/nsfs.h
> > +++ b/include/uapi/linux/nsfs.h
> > @@ -15,5 +15,7 @@
> > #define NS_GET_NSTYPE _IO(NSIO, 0x3)
> > /* Get owner UID (in the caller's user namespace) for a user
> > namespace */
> > #define NS_GET_OWNER_UID _IO(NSIO, 0x4)
> > +/* Get the id for a mount namespace */
> > +#define NS_GET_MNTNS_ID _IO(NSIO, 0x5)
> >
> > #endif /* __LINUX_NSFS_H */
>
> Thinking about this more...
>
> Would it also make sense to wire up a similar ioctl in pidfs? It seems
> like it might be nice to just open a pidfd for pid and then issue the
> above to get its mntns id, rather than having to grovel around in nsfs.
I had a different idea yesterday: get a mount namespace fd from a pidfd
in fact, get any namespace fd based on a pidfd. It's the equivalent to:
/proc/$pid/ns* and then you can avoid having to go via procfs at all.
Needs to be governed by ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS).
(We also need an ioctl() on the pidfd to get to the PID without procfs btw.)
