// SPDX-License-Identifier: GPL-2.0 #define _GNU_SOURCE #include <sched.h> #include <unistd.h> #include <stdio.h> #include <stdlib.h> #include <signal.h> #include <errno.h> #include <sys/types.h> #include <sys/stat.h> #include <fcntl.h> #include <sys/ioctl.h> #include <sys/prctl.h> #include <sys/wait.h> #define pr_err(fmt, ...) \ ({ \ fprintf(stderr, "%s:%d:" fmt ": %m\n", \ __func__, __LINE__, ##__VA_ARGS__); \ 1; \ }) #define NSIO 0xb7 #define NS_GET_USERNS _IO(NSIO, 0x1) #define NS_GET_PARENT _IO(NSIO, 0x2) #define __stack_aligned__ __attribute__((aligned(16))) struct cr_clone_arg { char stack[128] __stack_aligned__; char stack_ptr[0]; }; static int child(void *args) { prctl(PR_SET_PDEATHSIG, SIGKILL); while (1) sleep(1); exit(0); } int main(int argc, char *argv[]) { char *ns_strs[] = {"pid", "user"}; char path[] = "/proc/0123456789/ns/pid"; struct cr_clone_arg ca; struct stat st1, st2; int ns, pns, i; pid_t pid; pid = clone(child, ca.stack_ptr, CLONE_NEWUSER | CLONE_NEWPID | SIGCHLD, NULL); if (pid < 0) return pr_err("clone"); for (i = 0; i < 2; i++) { snprintf(path, sizeof(path), "/proc/%d/ns/%s", pid, ns_strs[i]); ns = open(path, O_RDONLY); if (ns < 0) return pr_err("Unable to open %s", path); pns = ioctl(ns, NS_GET_PARENT); if (pns < 0) return pr_err("Unable to get a parent pidns"); snprintf(path, sizeof(path), "/proc/self/ns/%s", ns_strs[i]); if (stat(path, &st2)) return pr_err("Unable to stat %s", path); if (fstat(pns, &st1)) return pr_err("Unable to stat the parent pidns"); if (st1.st_ino != st2.st_ino) return pr_err("NS_GET_PARENT returned a wrong namespace"); if (ioctl(pns, NS_GET_PARENT) >= 0 || errno != EPERM) return pr_err("Don't get EPERM"); } kill(pid, SIGKILL); wait(NULL); return 0; }