Merge pull request #24877 from brauner/namespace_utils

namespace-util: add an initial set of tweaks

src/basic/missing_sched.h

@@ -7,6 +7,11 @@
 #define CLONE_NEWCGROUP 0x02000000
 #endif
 
+/* 769071ac9f20b6a447410c7eaa55d1a5233ef40c (5.8) */
+#ifndef CLONE_NEWTIME
+#define CLONE_NEWTIME 0x00000080
+#endif
+
 /* Not exposed yet. Defined at include/linux/sched.h */
 #ifndef PF_KTHREAD
 #define PF_KTHREAD 0x00200000

src/basic/namespace-util.c

@@ -9,12 +9,30 @@
 #include "fileio.h"
 #include "missing_fs.h"
 #include "missing_magic.h"
+#include "missing_sched.h"
 #include "namespace-util.h"
 #include "process-util.h"
 #include "stat-util.h"
 #include "stdio-util.h"
 #include "user-util.h"
 
+const struct namespace_info namespace_info[] = {
+        [NAMESPACE_CGROUP] =  { "cgroup", "ns/cgroup", CLONE_NEWCGROUP,                          },
+        [NAMESPACE_IPC]    =  { "ipc",    "ns/ipc",    CLONE_NEWIPC,                             },
+        [NAMESPACE_NET]    =  { "net",    "ns/net",    CLONE_NEWNET,                             },
+        /* So, the mount namespace flag is called CLONE_NEWNS for historical
+         * reasons. Let's expose it here under a more explanatory name: "mnt".
+         * This is in-line with how the kernel exposes namespaces in /proc/$PID/ns. */
+        [NAMESPACE_MOUNT]  =  { "mnt",    "ns/mnt",    CLONE_NEWNS,                              },
+        [NAMESPACE_PID]    =  { "pid",    "ns/pid",    CLONE_NEWPID,                             },
+        [NAMESPACE_USER]   =  { "user",   "ns/user",   CLONE_NEWUSER,                            },
+        [NAMESPACE_UTS]    =  { "uts",    "ns/uts",    CLONE_NEWUTS,                             },
+        [NAMESPACE_TIME]   =  { "time",   "ns/time",   CLONE_NEWTIME,                            },
+        { /* Allow callers to iterate over the array without using _NAMESPACE_TYPE_MAX. */       },
+};
+
+#define pid_namespace_path(pid, type) procfs_file_alloca(pid, namespace_info[type].proc_path)
+
 int namespace_open(pid_t pid, int *pidns_fd, int *mntns_fd, int *netns_fd, int *userns_fd, int *root_fd) {
         _cleanup_close_ int pidnsfd = -1, mntnsfd = -1, netnsfd = -1, usernsfd = -1;
         int rfd = -1;
@@ -24,7 +42,7 @@ int namespace_open(pid_t pid, int *pidns_fd, int *mntns_fd, int *netns_fd, int *
         if (mntns_fd) {
                 const char *mntns;
 
-                mntns = procfs_file_alloca(pid, "ns/mnt");
+                mntns = pid_namespace_path(pid, NAMESPACE_MOUNT);
                 mntnsfd = open(mntns, O_RDONLY|O_NOCTTY|O_CLOEXEC);
                 if (mntnsfd < 0)
                         return -errno;
@@ -33,7 +51,7 @@ int namespace_open(pid_t pid, int *pidns_fd, int *mntns_fd, int *netns_fd, int *
         if (pidns_fd) {
                 const char *pidns;
 
-                pidns = procfs_file_alloca(pid, "ns/pid");
+                pidns = pid_namespace_path(pid, NAMESPACE_PID);
                 pidnsfd = open(pidns, O_RDONLY|O_NOCTTY|O_CLOEXEC);
                 if (pidnsfd < 0)
                         return -errno;
@@ -42,7 +60,7 @@ int namespace_open(pid_t pid, int *pidns_fd, int *mntns_fd, int *netns_fd, int *
         if (netns_fd) {
                 const char *netns;
 
-                netns = procfs_file_alloca(pid, "ns/net");
+                netns = pid_namespace_path(pid, NAMESPACE_NET);
                 netnsfd = open(netns, O_RDONLY|O_NOCTTY|O_CLOEXEC);
                 if (netnsfd < 0)
                         return -errno;
@@ -51,7 +69,7 @@ int namespace_open(pid_t pid, int *pidns_fd, int *mntns_fd, int *netns_fd, int *
         if (userns_fd) {
                 const char *userns;
 
-                userns = procfs_file_alloca(pid, "ns/user");
+                userns = pid_namespace_path(pid, NAMESPACE_USER);
                 usernsfd = open(userns, O_RDONLY|O_NOCTTY|O_CLOEXEC);
                 if (usernsfd < 0 && errno != ENOENT)
                         return -errno;
@@ -218,3 +236,27 @@ int userns_acquire(const char *uid_map, const char *gid_map) {
         return TAKE_FD(userns_fd);
 
 }
+
+int in_same_namespace(pid_t pid1, pid_t pid2, NamespaceType type) {
+        const char *ns_path;
+        struct stat ns_st1, ns_st2;
+
+        if (pid1 == 0)
+                pid1 = getpid_cached();
+
+        if (pid2 == 0)
+                pid2 = getpid_cached();
+
+        if (pid1 == pid2)
+                return 1;
+
+        ns_path = pid_namespace_path(pid1, type);
+        if (stat(ns_path, &ns_st1) < 0)
+                return -errno;
+
+        ns_path = pid_namespace_path(pid2, type);
+        if (stat(ns_path, &ns_st2) < 0)
+                return -errno;
+
+        return stat_inode_same(&ns_st1, &ns_st2);
+}

src/basic/namespace-util.h

@@ -3,6 +3,25 @@
 
 #include <sys/types.h>
 
+typedef enum NamespaceType {
+        NAMESPACE_CGROUP,
+        NAMESPACE_IPC,
+        NAMESPACE_NET,
+        NAMESPACE_MOUNT,
+        NAMESPACE_PID,
+        NAMESPACE_USER,
+        NAMESPACE_UTS,
+        NAMESPACE_TIME,
+        _NAMESPACE_TYPE_MAX,
+        _NAMESPACE_TYPE_INVALID = -EINVAL,
+} NamespaceType;
+
+extern const struct namespace_info {
+        const char *proc_name;
+        const char *proc_path;
+        unsigned int clone_flag;
+} namespace_info[_NAMESPACE_TYPE_MAX + 1];
+
 int namespace_open(pid_t pid, int *pidns_fd, int *mntns_fd, int *netns_fd, int *userns_fd, int *root_fd);
 int namespace_enter(int pidns_fd, int mntns_fd, int netns_fd, int userns_fd, int root_fd);
 
@@ -26,3 +45,4 @@ static inline bool userns_shift_range_valid(uid_t shift, uid_t range) {
 }
 
 int userns_acquire(const char *uid_map, const char *gid_map);
+int in_same_namespace(pid_t pid1, pid_t pid2, NamespaceType type);