Re: [PATCH v3 1/2] pidfd: show pids for nested pid namespaces in fdinfo
flat view
From: Jann Horn <jannh@google.com>
Date: 2019-10-11 14:56:30
Also in:
lkml
On Fri, Oct 11, 2019 at 2:23 PM Christian Kellner [off-list ref] wrote:
The fdinfo file for a process file descriptor already contains the pid of the process in the callers namespaces. Additionally, if pid namespaces are configured, show the process ids of the process in all nested namespaces in the same format as in the procfs status file, i.e. "NSPid:\t%d\%d...". This allows the easy identification of the processes in nested namespaces.
[...]
quoted hunk ↗ jump to hunk
#ifdef CONFIG_PROC_FS +static inline void print_pidfd_nspid(struct seq_file *m, struct pid *pid, + struct pid_namespace *ns)
`ns` is the namespace of the PID namespace of the procfs instance through which the file descriptor is being viewed.
quoted hunk ↗ jump to hunk
+{ +#ifdef CONFIG_PID_NS + int i; + + seq_puts(m, "\nNSpid:"); + for (i = ns->level; i <= pid->level; i++) {
ns->level is the level of the PID namespace associated with the procfs instance through which the file descriptor is being viewed. pid->level is the level of the PID associated with the pidfd.
quoted hunk ↗ jump to hunk
+ ns = pid->numbers[i].ns; + seq_put_decimal_ull(m, "\t", pid_nr_ns(pid, ns)); + } +#endif +}
I think you assumed that `ns` is always going to contain `pid`. However, that's not the case. Consider the following scenario: - the init_pid_ns has two child PID namespaces, A and B (each with its own mount namespace and procfs instance) - process P1 lives in A - process P2 lives in B - P1 opens a pidfd for itself - P1 passes the pidfd to P2 (e.g. via a unix domain socket) - P2 reads /proc/self/fdinfo/$pidfd Now the loop will print the ID of P1 in A. I don't think that's what you intended? You might want to bail out if "pid_nr_ns(pid, ns) == 0", or something like that.