Messages in this thread |  | | | Date | Thu, 10 Nov 2011 19:46:54 +0100 | | From | Oleg Nesterov <> | | Subject | Re: [PATCH 3/3] pids: Make it possible to clone tasks with given pids |
| |
On 11/10, Pavel Emelyanov wrote: > > The child_tidptr points to an array of pids for current namespace and > its ancestors. When 0 is met in this array the pid number for the > corresponding namespace is generated, rather than set.
I must have missed something, but I can't unserstand how this works.
> For security reasons after a regular clone/fork is done in a namespace > further cloning with predefined pid is not allowed.
I guess, this is pid_ns->last_pid != 0 check in set_pidmap(), right ?
> +static int set_pidmap(struct pid_namespace *pid_ns, int pid) > +{ > + int offset; > + struct pidmap *map; > + > + offset = pid & BITS_PER_PAGE_MASK; > + map = &pid_ns->pidmap[pid/BITS_PER_PAGE]; > + > + if (unlikely(!map->page)) > + if (alloc_pidmap_page(map)) > + return -ENOMEM; > + > + if (pid_ns->last_pid != 0) > + return -EPERM;
OK, but it should be always true, no? IOW, set_pidmap() should always fail?
Unless: you are using CLONE_NEWPID along with CLONE_CHILD_USEPIDS and this child_tidptr array has only one pid (before zero pid).
So, could you please explain what I have missed?
Oleg.
|  |