File: linux_pid_namespace_support.md

package info (click to toggle)
chromium-browser 57.0.2987.98-1~deb8u1
  • links: PTS, VCS
  • area: main
  • in suites: jessie
  • size: 2,637,852 kB
  • ctags: 2,544,394
  • sloc: cpp: 12,815,961; ansic: 3,676,222; python: 1,147,112; asm: 526,608; java: 523,212; xml: 286,794; perl: 92,654; sh: 86,408; objc: 73,271; makefile: 27,698; cs: 18,487; yacc: 13,031; tcl: 12,957; pascal: 4,875; ml: 4,716; lex: 3,904; sql: 3,862; ruby: 1,982; lisp: 1,508; php: 1,368; exp: 404; awk: 325; csh: 117; jsp: 39; sed: 37
file content (48 lines) | stat: -rw-r--r-- 1,093 bytes parent folder | download | duplicates (5) 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
 
# Linux PID Namespace Support

The [LinuxSUIDSandbox](linux_suid_sandbox.md) currently relies on support for
the `CLONE_NEWPID` flag in Linux's
[clone() system call](http://www.kernel.org/doc/man-pages/online/pages/man2/clone.2.html).
You can check whether your system supports PID namespaces with the code below,
which must be run as root:

```c
#define _GNU_SOURCE
#include <unistd.h>
#include <sched.h>
#include <stdio.h>
#include <sys/wait.h>

#if !defined(CLONE_NEWPID)
#define CLONE_NEWPID 0x20000000
#endif

int worker(void* arg) {
  const pid_t pid = getpid();
  if (pid == 1) {
    printf("PID namespaces are working\n");
  } else {
    printf("PID namespaces ARE NOT working. Child pid: %d\n", pid);
  }

  return 0;
}

int main() {
  if (getuid()) {
    fprintf(stderr, "Must be run as root.\n");
    return 1;
  }

  char stack[8192];
  const pid_t child = clone(worker, stack + sizeof(stack), CLONE_NEWPID, NULL);
  if (child == -1) {
    perror("clone");
    fprintf(stderr, "Clone failed. PID namespaces ARE NOT supported\n");
  }

  waitpid(child, NULL, 0);

  return 0;
}
```