github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-12 16:18:45 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge patch series "procfs: make reference pidns more user-visible"

Browse Source 
Aleksa Sarai <cyphar@cyphar.com> says:

Ever since the introduction of pid namespaces, procfs has had very
implicit behaviour surrounding them (the pidns used by a procfs mount is
auto-selected based on the mounting process's active pidns, and the
pidns itself is basically hidden once the mount has been constructed).

/* pidns mount option for procfs */

This implicit behaviour has historically meant that userspace was
required to do some special dances in order to configure the pidns of a
procfs mount as desired. Examples include:

 * In order to bypass the mnt_too_revealing() check, Kubernetes creates
   a procfs mount from an empty pidns so that user namespaced containers
   can be nested (without this, the nested containers would fail to
   mount procfs). But this requires forking off a helper process because
   you cannot just one-shot this using mount(2).

 * Container runtimes in general need to fork into a container before
   configuring its mounts, which can lead to security issues in the case
   of shared-pidns containers (a privileged process in the pidns can
   interact with your container runtime process). While
   SUID_DUMP_DISABLE and user namespaces make this less of an issue, the
   strict need for this due to a minor uAPI wart is kind of unfortunate.

Things would be much easier if there was a way for userspace to just
specify the pidns they want. Patch 1 implements a new "pidns" argument
which can be set using fsconfig(2):

    fsconfig(procfd, FSCONFIG_SET_FD, "pidns", NULL, nsfd);
    fsconfig(procfd, FSCONFIG_SET_STRING, "pidns", "/proc/self/ns/pid", 0);

or classic mount(2) / mount(8):

    // mount -t proc -o pidns=/proc/self/ns/pid proc /tmp/proc
    mount("proc", "/tmp/proc", "proc", MS_..., "pidns=/proc/self/ns/pid");

The initial security model I have in this RFC is to be as conservative
as possible and just mirror the security model for setns(2) -- which
means that you can only set pidns=... to pid namespaces that your
current pid namespace is a direct ancestor of and you have CAP_SYS_ADMIN
privileges over the pid namespace. This fulfils the requirements of
container runtimes, but I suspect that this may be too strict for some
usecases.

The pidns argument is not displayed in mountinfo -- it's not clear to me
what value it would make sense to show (maybe we could just use ns_dname
to provide an identifier for the namespace, but this number would be
fairly useless to userspace). I'm open to suggestions. Note that
PROCFS_GET_PID_NAMESPACE (see below) does at least let userspace get
information about this outside of mountinfo.

Note that you cannot change the pidns of an already-created procfs
instance. The primary reason is that allowing this to be changed would
require RCU-protecting proc_pid_ns(sb) and thus auditing all of
fs/proc/* and some of the users in fs/* to make sure they wouldn't UAF
the pid namespace. Since creating procfs instances is very cheap, it
seems unnecessary to overcomplicate this upfront. Trying to reconfigure
procfs this way errors out with -EBUSY.

* patches from https://lore.kernel.org/20250805-procfs-pidns-api-v4-0-705f984940e7@cyphar.com:
  selftests/proc: add tests for new pidns APIs
  procfs: add "pidns" mount option
  pidns: move is-ancestor logic to helper

Link: https://lore.kernel.org/20250805-procfs-pidns-api-v4-0-705f984940e7@cyphar.com
Signed-off-by: Christian Brauner <brauner@kernel.org>
This commit is contained in:
Christian Brauner 2025-09-02 11:37:34 +02:00
commit 46582a15c1
No known key found for this signature in database
GPG Key ID: 91C61BC06578DCA2
7 changed files with 336 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
Documentation/filesystems/proc.rst
View File

@ -2362,6 +2362,7 @@ The following mount options are supported:
hidepid= Set /proc/<pid>/ access mode.
gid= Set the group authorized to learn processes information.
subset= Show only the specified subset of procfs.
pidns= Specify a the namespace used by this procfs.
========= ========================================================
hidepid=off or hidepid=0 means classic mode - everybody may access all
@ -2394,6 +2395,13 @@ information about processes information, just add identd to this group.
subset=pid hides all top level files and directories in the procfs that
are not related to tasks.
pidns= specifies a pid namespace (either as a string path to something like
`/proc/$pid/ns/pid`, or a file descriptor when using `FSCONFIG_SET_FD`) that
will be used by the procfs instance when translating pids. By default, procfs
will use the calling process's active pid namespace. Note that the pid
namespace of an existing procfs instance cannot be modified (attempting to do
so will give an `-EBUSY` error).
Chapter 5: Filesystem behavior
==============================

98
fs/proc/root.c
View File

@ -38,12 +38,14 @@ enum proc_param {
Opt_gid,
Opt_hidepid,
Opt_subset,
Opt_pidns,
};
static const struct fs_parameter_spec proc_fs_parameters[] = {
fsparam_u32("gid", Opt_gid),
fsparam_u32("gid", Opt_gid),
fsparam_string("hidepid", Opt_hidepid),
fsparam_string("subset", Opt_subset),
fsparam_file_or_string("pidns", Opt_pidns),
{}
};
@ -109,11 +111,66 @@ static int proc_parse_subset_param(struct fs_context *fc, char *value)
return 0;
}
#ifdef CONFIG_PID_NS
static int proc_parse_pidns_param(struct fs_context *fc,
struct fs_parameter *param,
struct fs_parse_result *result)
{
struct proc_fs_context *ctx = fc->fs_private;
struct pid_namespace *target, *active = task_active_pid_ns(current);
struct ns_common *ns;
struct file *ns_filp __free(fput) = NULL;
switch (param->type) {
case fs_value_is_file:
/* came through fsconfig, steal the file reference */
ns_filp = no_free_ptr(param->file);
break;
case fs_value_is_string:
ns_filp = filp_open(param->string, O_RDONLY, 0);
break;
default:
WARN_ON_ONCE(true);
break;
}
if (!ns_filp)
ns_filp = ERR_PTR(-EBADF);
if (IS_ERR(ns_filp)) {
errorfc(fc, "could not get file from pidns argument");
return PTR_ERR(ns_filp);
}
if (!proc_ns_file(ns_filp))
return invalfc(fc, "pidns argument is not an nsfs file");
ns = get_proc_ns(file_inode(ns_filp));
if (ns->ops->type != CLONE_NEWPID)
return invalfc(fc, "pidns argument is not a pidns file");
target = container_of(ns, struct pid_namespace, ns);
/*
* pidns= is shorthand for joining the pidns to get a fsopen fd, so the
* permission model should be the same as pidns_install().
*/
if (!ns_capable(target->user_ns, CAP_SYS_ADMIN)) {
errorfc(fc, "insufficient permissions to set pidns");
return -EPERM;
}
if (!pidns_is_ancestor(target, active))
return invalfc(fc, "cannot set pidns to non-descendant pidns");
put_pid_ns(ctx->pid_ns);
ctx->pid_ns = get_pid_ns(target);
put_user_ns(fc->user_ns);
fc->user_ns = get_user_ns(ctx->pid_ns->user_ns);
return 0;
}
#endif /* CONFIG_PID_NS */
static int proc_parse_param(struct fs_context *fc, struct fs_parameter *param)
{
struct proc_fs_context *ctx = fc->fs_private;
struct fs_parse_result result;
int opt;
int opt, err;
opt = fs_parse(fc, proc_fs_parameters, param, &result);
if (opt < 0)
@ -125,15 +182,39 @@ static int proc_parse_param(struct fs_context *fc, struct fs_parameter *param)
break;
case Opt_hidepid:
if (proc_parse_hidepid_param(fc, param))
return -EINVAL;
err = proc_parse_hidepid_param(fc, param);
if (err)
return err;
break;
case Opt_subset:
if (proc_parse_subset_param(fc, param->string) < 0)
return -EINVAL;
err = proc_parse_subset_param(fc, param->string);
if (err)
return err;
break;
case Opt_pidns:
#ifdef CONFIG_PID_NS
/*
* We would have to RCU-protect every proc_pid_ns() or
* proc_sb_info() access if we allowed this to be reconfigured
* for an existing procfs instance. Luckily, procfs instances
* are cheap to create, and mount-beneath would let you
* atomically replace an instance even with overmounts.
*/
if (fc->purpose == FS_CONTEXT_FOR_RECONFIGURE) {
errorfc(fc, "cannot reconfigure pidns for existing procfs");
return -EBUSY;
}
err = proc_parse_pidns_param(fc, param, &result);
if (err)
return err;
break;
#else
errorfc(fc, "pidns mount flag not supported on this system");
return -EOPNOTSUPP;
#endif
default:
return -EINVAL;
}
@ -154,6 +235,11 @@ static void proc_apply_options(struct proc_fs_info *fs_info,
fs_info->hide_pid = ctx->hidepid;
if (ctx->mask & (1 << Opt_subset))
fs_info->pidonly = ctx->pidonly;
if (ctx->mask & (1 << Opt_pidns) &&
!WARN_ON_ONCE(fc->purpose == FS_CONTEXT_FOR_RECONFIGURE)) {
put_pid_ns(fs_info->pid_ns);
fs_info->pid_ns = get_pid_ns(ctx->pid_ns);
}
}
static int proc_fill_super(struct super_block *s, struct fs_context *fc)

9
include/linux/pid_namespace.h
View File

@ -84,6 +84,9 @@ extern void zap_pid_ns_processes(struct pid_namespace *pid_ns);
extern int reboot_pid_ns(struct pid_namespace *pid_ns, int cmd);
extern void put_pid_ns(struct pid_namespace *ns);
extern bool pidns_is_ancestor(struct pid_namespace *child,
struct pid_namespace *ancestor);
#else /* !CONFIG_PID_NS */
#include <linux/err.h>
@ -118,6 +121,12 @@ static inline int reboot_pid_ns(struct pid_namespace *pid_ns, int cmd)
{
return 0;
}
static inline bool pidns_is_ancestor(struct pid_namespace *child,
struct pid_namespace *ancestor)
{
return false;
}
#endif /* CONFIG_PID_NS */
extern struct pid_namespace *task_active_pid_ns(struct task_struct *tsk);

22
kernel/pid_namespace.c
View File

@ -390,11 +390,23 @@ static void pidns_put(struct ns_common *ns)
put_pid_ns(to_pid_ns(ns));
}
bool pidns_is_ancestor(struct pid_namespace *child,
struct pid_namespace *ancestor)
{
struct pid_namespace *ns;
if (child->level < ancestor->level)
return false;
for (ns = child; ns->level > ancestor->level; ns = ns->parent)
;
return ns == ancestor;
}
static int pidns_install(struct nsset *nsset, struct ns_common *ns)
{
struct nsproxy *nsproxy = nsset->nsproxy;
struct pid_namespace *active = task_active_pid_ns(current);
struct pid_namespace *ancestor, *new = to_pid_ns(ns);
struct pid_namespace *new = to_pid_ns(ns);
if (!ns_capable(new->user_ns, CAP_SYS_ADMIN) ||
!ns_capable(nsset->cred->user_ns, CAP_SYS_ADMIN))
@ -408,13 +420,7 @@ static int pidns_install(struct nsset *nsset, struct ns_common *ns)
* this maintains the property that processes and their
* children can not escape their current pid namespace.
*/
if (new->level < active->level)
return -EINVAL;
ancestor = new;
while (ancestor->level > active->level)
ancestor = ancestor->parent;
if (ancestor != active)
if (!pidns_is_ancestor(new, active))
return -EINVAL;
put_pid_ns(nsproxy->pid_ns_for_children);

1
tools/testing/selftests/proc/.gitignore vendored
View File

@ -18,6 +18,7 @@
/proc-tid0
/proc-uptime-001
/proc-uptime-002
/proc-pidns
/read
/self
/setns-dcache

1
tools/testing/selftests/proc/Makefile
View File

@ -28,5 +28,6 @@ TEST_GEN_PROGS += setns-sysvipc
TEST_GEN_PROGS += thread-self
TEST_GEN_PROGS += proc-multiple-procfs
TEST_GEN_PROGS += proc-fsconfig-hidepid
TEST_GEN_PROGS += proc-pidns
include ../lib.mk

211
tools/testing/selftests/proc/proc-pidns.c Normal file
View File

@ -0,0 +1,211 @@
// SPDX-License-Identifier: GPL-2.0-or-later
/*
* Author: Aleksa Sarai <cyphar@cyphar.com>
* Copyright (C) 2025 SUSE LLC.
*/
#include <assert.h>
#include <errno.h>
#include <sched.h>
#include <stdbool.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <stdio.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/prctl.h>
#include "../kselftest_harness.h"
#define ASSERT_ERRNO(expected, _t, seen) \
__EXPECT(expected, #expected, \
({__typeof__(seen) _tmp_seen = (seen); \
_tmp_seen >= 0 ? _tmp_seen : -errno; }), #seen, _t, 1)
#define ASSERT_ERRNO_EQ(expected, seen) \
ASSERT_ERRNO(expected, ==, seen)
#define ASSERT_SUCCESS(seen) \
ASSERT_ERRNO(0, <=, seen)
static int touch(char *path)
{
int fd = open(path, O_WRONLY|O_CREAT|O_CLOEXEC, 0644);
if (fd < 0)
return -1;
return close(fd);
}
FIXTURE(ns)
{
int host_mntns, host_pidns;
int dummy_pidns;
};
FIXTURE_SETUP(ns)
{
/* Stash the old mntns. */
self->host_mntns = open("/proc/self/ns/mnt", O_RDONLY|O_CLOEXEC);
ASSERT_SUCCESS(self->host_mntns);
/* Create a new mount namespace and make it private. */
ASSERT_SUCCESS(unshare(CLONE_NEWNS));
ASSERT_SUCCESS(mount(NULL, "/", NULL, MS_PRIVATE|MS_REC, NULL));
/*
* Create a proper tmpfs that we can use and will disappear once we
* leave this mntns.
*/
ASSERT_SUCCESS(mount("tmpfs", "/tmp", "tmpfs", 0, NULL));
/*
* Create a pidns we can use for later tests. We need to fork off a
* child so that we get a usable nsfd that we can bind-mount and open.
*/
ASSERT_SUCCESS(mkdir("/tmp/dummy", 0755));
ASSERT_SUCCESS(touch("/tmp/dummy/pidns"));
ASSERT_SUCCESS(mkdir("/tmp/dummy/proc", 0755));
self->host_pidns = open("/proc/self/ns/pid", O_RDONLY|O_CLOEXEC);
ASSERT_SUCCESS(self->host_pidns);
ASSERT_SUCCESS(unshare(CLONE_NEWPID));
pid_t pid = fork();
ASSERT_SUCCESS(pid);
if (!pid) {
prctl(PR_SET_PDEATHSIG, SIGKILL);
ASSERT_SUCCESS(mount("/proc/self/ns/pid", "/tmp/dummy/pidns", NULL, MS_BIND, NULL));
ASSERT_SUCCESS(mount("proc", "/tmp/dummy/proc", "proc", 0, NULL));
exit(0);
}
int wstatus;
ASSERT_EQ(waitpid(pid, &wstatus, 0), pid);
ASSERT_TRUE(WIFEXITED(wstatus));
ASSERT_EQ(WEXITSTATUS(wstatus), 0);
ASSERT_SUCCESS(setns(self->host_pidns, CLONE_NEWPID));
self->dummy_pidns = open("/tmp/dummy/pidns", O_RDONLY|O_CLOEXEC);
ASSERT_SUCCESS(self->dummy_pidns);
}
FIXTURE_TEARDOWN(ns)
{
ASSERT_SUCCESS(setns(self->host_mntns, CLONE_NEWNS));
ASSERT_SUCCESS(close(self->host_mntns));
ASSERT_SUCCESS(close(self->host_pidns));
ASSERT_SUCCESS(close(self->dummy_pidns));
}
TEST_F(ns, pidns_mount_string_path)
{
ASSERT_SUCCESS(mkdir("/tmp/proc-host", 0755));
ASSERT_SUCCESS(mount("proc", "/tmp/proc-host", "proc", 0, "pidns=/proc/self/ns/pid"));
ASSERT_SUCCESS(access("/tmp/proc-host/self/", X_OK));
ASSERT_SUCCESS(mkdir("/tmp/proc-dummy", 0755));
ASSERT_SUCCESS(mount("proc", "/tmp/proc-dummy", "proc", 0, "pidns=/tmp/dummy/pidns"));
ASSERT_ERRNO_EQ(-ENOENT, access("/tmp/proc-dummy/1/", X_OK));
ASSERT_ERRNO_EQ(-ENOENT, access("/tmp/proc-dummy/self/", X_OK));
}
TEST_F(ns, pidns_fsconfig_string_path)
{
int fsfd = fsopen("proc", FSOPEN_CLOEXEC);
ASSERT_SUCCESS(fsfd);
ASSERT_SUCCESS(fsconfig(fsfd, FSCONFIG_SET_STRING, "pidns", "/tmp/dummy/pidns", 0));
ASSERT_SUCCESS(fsconfig(fsfd, FSCONFIG_CMD_CREATE, NULL, NULL, 0));
int mountfd = fsmount(fsfd, FSMOUNT_CLOEXEC, 0);
ASSERT_SUCCESS(mountfd);
ASSERT_ERRNO_EQ(-ENOENT, faccessat(mountfd, "1/", X_OK, 0));
ASSERT_ERRNO_EQ(-ENOENT, faccessat(mountfd, "self/", X_OK, 0));
ASSERT_SUCCESS(close(fsfd));
ASSERT_SUCCESS(close(mountfd));
}
TEST_F(ns, pidns_fsconfig_fd)
{
int fsfd = fsopen("proc", FSOPEN_CLOEXEC);
ASSERT_SUCCESS(fsfd);
ASSERT_SUCCESS(fsconfig(fsfd, FSCONFIG_SET_FD, "pidns", NULL, self->dummy_pidns));
ASSERT_SUCCESS(fsconfig(fsfd, FSCONFIG_CMD_CREATE, NULL, NULL, 0));
int mountfd = fsmount(fsfd, FSMOUNT_CLOEXEC, 0);
ASSERT_SUCCESS(mountfd);
ASSERT_ERRNO_EQ(-ENOENT, faccessat(mountfd, "1/", X_OK, 0));
ASSERT_ERRNO_EQ(-ENOENT, faccessat(mountfd, "self/", X_OK, 0));
ASSERT_SUCCESS(close(fsfd));
ASSERT_SUCCESS(close(mountfd));
}
TEST_F(ns, pidns_reconfigure_remount)
{
ASSERT_SUCCESS(mkdir("/tmp/proc", 0755));
ASSERT_SUCCESS(mount("proc", "/tmp/proc", "proc", 0, ""));
ASSERT_SUCCESS(access("/tmp/proc/1/", X_OK));
ASSERT_SUCCESS(access("/tmp/proc/self/", X_OK));
ASSERT_ERRNO_EQ(-EBUSY, mount(NULL, "/tmp/proc", NULL, MS_REMOUNT, "pidns=/tmp/dummy/pidns"));
ASSERT_SUCCESS(access("/tmp/proc/1/", X_OK));
ASSERT_SUCCESS(access("/tmp/proc/self/", X_OK));
}
TEST_F(ns, pidns_reconfigure_fsconfig_string_path)
{
int fsfd = fsopen("proc", FSOPEN_CLOEXEC);
ASSERT_SUCCESS(fsfd);
ASSERT_SUCCESS(fsconfig(fsfd, FSCONFIG_CMD_CREATE, NULL, NULL, 0));
int mountfd = fsmount(fsfd, FSMOUNT_CLOEXEC, 0);
ASSERT_SUCCESS(mountfd);
ASSERT_SUCCESS(faccessat(mountfd, "1/", X_OK, 0));
ASSERT_SUCCESS(faccessat(mountfd, "self/", X_OK, 0));
ASSERT_ERRNO_EQ(-EBUSY, fsconfig(fsfd, FSCONFIG_SET_STRING, "pidns", "/tmp/dummy/pidns", 0));
ASSERT_SUCCESS(fsconfig(fsfd, FSCONFIG_CMD_RECONFIGURE, NULL, NULL, 0)); /* noop */
ASSERT_SUCCESS(faccessat(mountfd, "1/", X_OK, 0));
ASSERT_SUCCESS(faccessat(mountfd, "self/", X_OK, 0));
ASSERT_SUCCESS(close(fsfd));
ASSERT_SUCCESS(close(mountfd));
}
TEST_F(ns, pidns_reconfigure_fsconfig_fd)
{
int fsfd = fsopen("proc", FSOPEN_CLOEXEC);
ASSERT_SUCCESS(fsfd);
ASSERT_SUCCESS(fsconfig(fsfd, FSCONFIG_CMD_CREATE, NULL, NULL, 0));
int mountfd = fsmount(fsfd, FSMOUNT_CLOEXEC, 0);
ASSERT_SUCCESS(mountfd);
ASSERT_SUCCESS(faccessat(mountfd, "1/", X_OK, 0));
ASSERT_SUCCESS(faccessat(mountfd, "self/", X_OK, 0));
ASSERT_ERRNO_EQ(-EBUSY, fsconfig(fsfd, FSCONFIG_SET_FD, "pidns", NULL, self->dummy_pidns));
ASSERT_SUCCESS(fsconfig(fsfd, FSCONFIG_CMD_RECONFIGURE, NULL, NULL, 0)); /* noop */
ASSERT_SUCCESS(faccessat(mountfd, "1/", X_OK, 0));
ASSERT_SUCCESS(faccessat(mountfd, "self/", X_OK, 0));
ASSERT_SUCCESS(close(fsfd));
ASSERT_SUCCESS(close(mountfd));
}
TEST_HARNESS_MAIN