Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754030AbcLLGN0 (ORCPT ); Mon, 12 Dec 2016 01:13:26 -0500 Received: from mail-wm0-f68.google.com ([74.125.82.68]:35634 "EHLO mail-wm0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750796AbcLLGNY (ORCPT ); Mon, 12 Dec 2016 01:13:24 -0500 Subject: Re: Documenting the ioctl interfaces to discover relationships between namespaces To: "Eric W. Biederman" References: <87poky5ca9.fsf@xmission.com> Cc: mtk.manpages@gmail.com, Andrei Vagin , Containers , Linux API , lkml , "linux-fsdevel@vger.kernel.org" , James Bottomley , "W. Trevor King" , Alexander Viro , "Serge E. Hallyn" From: "Michael Kerrisk (man-pages)" Message-ID: <3552ea0d-07a8-5fb7-d863-f678901bed09@gmail.com> Date: Mon, 12 Dec 2016 07:13:18 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.4.0 MIME-Version: 1.0 In-Reply-To: <87poky5ca9.fsf@xmission.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2996 Lines: 79 [Fixing Serge's address in my original CC] On 12/11/2016 11:30 PM, Eric W. Biederman wrote: > "Michael Kerrisk (man-pages)" writes: > >> [was: [PATCH 0/4 v3] Add an interface to discover relationships >> between namespaces] > > One small comment below. > >> >> Introspecting namespace relationships >> Since Linux 4.9, two ioctl(2) operations are provided to allow >> introspection of namespace relationships (see user_namespaces(7) >> and pid_namespaces(7)). The form of the calls is: >> >> ioctl(fd, request); >> >> In each case, fd refers to a /proc/[pid]/ns/* file. >> >> NS_GET_USERNS >> Returns a file descriptor that refers to the owning user >> namespace for the namespace referred to by fd. >> >> NS_GET_PARENT >> Returns a file descriptor that refers to the parent names‐ >> pace of the namespace referred to by fd. This operation is >> valid only for hierarchical namespaces (i.e., PID and user >> namespaces). For user namespaces, NS_GET_PARENT is synony‐ >> mous with NS_GET_USERNS. >> >> In each case, the returned file descriptor is opened with O_RDONLY >> and O_CLOEXEC (close-on-exec). >> >> By applying fstat(2) to the returned file descriptor, one obtains >> a stat structure whose st_ino (inode number) field identifies the >> owning/parent namespace. This inode number can be matched with >> the inode number of another /proc/[pid]/ns/{pid,user} file to >> determine whether that is the owning/parent namespace. > > Like all fstat inode comparisons to be fully accurate you need to > compare both the st_ino and st_dev. I reserve the right for st_dev to > be significant when comparing namespaces. Otherwise I might have to > create a namespace of namespaces someday and that is ugly. Ah yes. Thanks for catching that. I've adjusted the text, and the example program. Cheers, Michael >> Either of these ioctl(2) operations can fail with the following >> error: >> >> EPERM The requested namespace is outside of the caller's names‐ >> pace scope. This error can occur if, for example, the own‐ >> ing user namespace is an ancestor of the caller's current >> user namespace. It can also occur on attempts to obtain >> the parent of the initial user or PID namespace. >> >> Additionally, the NS_GET_PARENT operation can fail with the fol‐ >> lowing error: >> >> EINVAL fd refers to a nonhierarchical namespace. >> >> See the EXAMPLE section for an example of the use of these opera‐ >> tions. >> >> [...] > > Eric > -- Michael Kerrisk Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/ Linux/UNIX System Programming Training: http://man7.org/training/