pidns: move is-ancestor logic to helper

This check will be needed in later patches, and there's no point
open-coding it each time.

Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
Link: https://lore.kernel.org/20250805-procfs-pidns-api-v4-1-705f984940e7@cyphar.com
Signed-off-by: Christian Brauner <brauner@kernel.org>

diff --git a/include/linux/pid_namespace.h b/include/linux/pid_namespace.h
index 7c67a58111998d9bcb1ba29c017acb249286ec38..17fdc059f8da8394fbd7605860b8508446ceb04a 100644 (file)
--- a/include/linux/pid_namespace.h
+++ b/include/linux/pid_namespace.h
@@ -84,6 +84,9 @@ extern void zap_pid_ns_processes(struct pid_namespace *pid_ns);
 extern int reboot_pid_ns(struct pid_namespace *pid_ns, int cmd);
 extern void put_pid_ns(struct pid_namespace *ns);
 
+extern bool pidns_is_ancestor(struct pid_namespace *child,
+                             struct pid_namespace *ancestor);
+
 #else /* !CONFIG_PID_NS */
 #include <linux/err.h>
 
@@ -118,6 +121,12 @@ static inline int reboot_pid_ns(struct pid_namespace *pid_ns, int cmd)
 {
        return 0;
 }
+
+static inline bool pidns_is_ancestor(struct pid_namespace *child,
+                                    struct pid_namespace *ancestor)
+{
+       return false;
+}
 #endif /* CONFIG_PID_NS */
 
 extern struct pid_namespace *task_active_pid_ns(struct task_struct *tsk);

diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c
index 7098ed44e717d3da8f518f3826cb8047bb744786..b7b45c2597ec2f4d8387d59eb0f9d40485849bee 100644 (file)
--- a/kernel/pid_namespace.c
+++ b/kernel/pid_namespace.c
@@ -390,11 +390,23 @@ static void pidns_put(struct ns_common *ns)
        put_pid_ns(to_pid_ns(ns));
 }
 
+bool pidns_is_ancestor(struct pid_namespace *child,
+                      struct pid_namespace *ancestor)
+{
+       struct pid_namespace *ns;
+
+       if (child->level < ancestor->level)
+               return false;
+       for (ns = child; ns->level > ancestor->level; ns = ns->parent)
+               ;
+       return ns == ancestor;
+}
+
 static int pidns_install(struct nsset *nsset, struct ns_common *ns)
 {
        struct nsproxy *nsproxy = nsset->nsproxy;
        struct pid_namespace *active = task_active_pid_ns(current);
-       struct pid_namespace *ancestor, *new = to_pid_ns(ns);
+       struct pid_namespace *new = to_pid_ns(ns);
 
        if (!ns_capable(new->user_ns, CAP_SYS_ADMIN) ||
            !ns_capable(nsset->cred->user_ns, CAP_SYS_ADMIN))
@@ -408,13 +420,7 @@ static int pidns_install(struct nsset *nsset, struct ns_common *ns)
         * this maintains the property that processes and their
         * children can not escape their current pid namespace.
         */
-       if (new->level < active->level)
-               return -EINVAL;
-
-       ancestor = new;
-       while (ancestor->level > active->level)
-               ancestor = ancestor->parent;
-       if (ancestor != active)
+       if (!pidns_is_ancestor(new, active))
                return -EINVAL;
 
        put_pid_ns(nsproxy->pid_ns_for_children);