core: delegate mountns implicitly when any of pidns/cgns/netns is in use

2025-03-30 18:57:18 +02:00
parent 2b4cfbf91f
commit 32b69b190b
3 changed files with 17 additions and 2 deletions
@@ -4275,7 +4275,17 @@ static bool exec_namespace_is_delegated(
        if (context->delegate_namespaces == NAMESPACE_FLAGS_INITIAL)
                return params->runtime_scope == RUNTIME_SCOPE_USER;

-        return FLAGS_SET(context->delegate_namespaces, namespace);
+        if (FLAGS_SET(context->delegate_namespaces, namespace))
+                return true;
+
+        /* Various namespaces imply mountns for private procfs/sysfs/cgroupfs instances, which means when
+         * those are delegated mountns must be deferred too.
+         *
+         * The list should stay in sync with exec_needs_mount_namespace(). */
+        if (namespace == CLONE_NEWNS)
+                return context->delegate_namespaces & (CLONE_NEWPID|CLONE_NEWCGROUP|CLONE_NEWNET);
+
+        return false;
 }

 static int setup_delegated_namespaces(