diff options
| author | Aleksa Sarai <cyphar@cyphar.com> | 2025-08-05 15:45:08 +1000 |
|---|---|---|
| committer | Christian Brauner <brauner@kernel.org> | 2025-09-02 11:37:24 +0200 |
| commit | 7df87820122acd3204565109f636a1367912655a (patch) | |
| tree | ff91f35f804b422001219c5057815b38afbf49bf /kernel | |
| parent | Merge patch series "vfs: if RESOLVE_NO_XDEV passed to openat2, don't *trigger... (diff) | |
| download | linux-7df87820122acd3204565109f636a1367912655a.tar.gz linux-7df87820122acd3204565109f636a1367912655a.zip | |
pidns: move is-ancestor logic to helper
This check will be needed in later patches, and there's no point
open-coding it each time.
Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
Link: https://lore.kernel.org/20250805-procfs-pidns-api-v4-1-705f984940e7@cyphar.com
Signed-off-by: Christian Brauner <brauner@kernel.org>
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/pid_namespace.c | 22 |
1 files changed, 14 insertions, 8 deletions
diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c index 7098ed44e717..b7b45c2597ec 100644 --- a/kernel/pid_namespace.c +++ b/kernel/pid_namespace.c @@ -390,11 +390,23 @@ static void pidns_put(struct ns_common *ns) put_pid_ns(to_pid_ns(ns)); } +bool pidns_is_ancestor(struct pid_namespace *child, + struct pid_namespace *ancestor) +{ + struct pid_namespace *ns; + + if (child->level < ancestor->level) + return false; + for (ns = child; ns->level > ancestor->level; ns = ns->parent) + ; + return ns == ancestor; +} + static int pidns_install(struct nsset *nsset, struct ns_common *ns) { struct nsproxy *nsproxy = nsset->nsproxy; struct pid_namespace *active = task_active_pid_ns(current); - struct pid_namespace *ancestor, *new = to_pid_ns(ns); + struct pid_namespace *new = to_pid_ns(ns); if (!ns_capable(new->user_ns, CAP_SYS_ADMIN) || !ns_capable(nsset->cred->user_ns, CAP_SYS_ADMIN)) @@ -408,13 +420,7 @@ static int pidns_install(struct nsset *nsset, struct ns_common *ns) * this maintains the property that processes and their * children can not escape their current pid namespace. */ - if (new->level < active->level) - return -EINVAL; - - ancestor = new; - while (ancestor->level > active->level) - ancestor = ancestor->parent; - if (ancestor != active) + if (!pidns_is_ancestor(new, active)) return -EINVAL; put_pid_ns(nsproxy->pid_ns_for_children); |