[PATCH v3 1/4] pidfd: restrict task access ioctls to the caller's pid namespace

[sashiko-bot at kernel.org]

> From: Chen Linxuan <me at black-desk.cn>
> 
> pidfds can cross pid namespace boundaries: a task may obtain one for a
> process outside of its own pid namespace hierarchy through SO_PASSPIDFD
> or SO_PEERPIDFD, via SCM_RIGHTS, or through file descriptor inheritance.
> 
> The namespace ioctls gate access with a ptrace check against the
> target's credentials only. That check does not account for the pid
> namespace relationship between the caller and the target, so a task
> inside a pid namespace can use a pidfd obtained across that boundary to
> acquire namespace file descriptors of a task outside of its hierarchy.
> 
> procfs exposes the equivalent information only for tasks visible in the
> reader's pid namespace, and PIDFD_GET_INFO already answers with -EREMOTE
> for targets outside the caller's hierarchy. Extend that policy to the
> namespace ioctls: fail with -EREMOTE unless the target is visible in the
> caller's active pid namespace. Callers in ancestor pid namespaces are
> unaffected.
> 
> Unlike PIDFD_GET_INFO, the visibility check is performed after the task
> lookup here, so reaped targets outside of the caller's pid namespace
> hierarchy answer -ESRCH instead of -EREMOTE.
> 
> Link: https://lore.kernel.org/all/CAG48ez1T5-tUHVK_iHsgUtWa-inVdrZxA3E-ZCW0iENJvasKfg@mail.gmail.com
> Link: https://lore.kernel.org/all/20260925-gewischt-auftrag-tierzucht-c153cb3f9f74@brauner
> Suggested-by: Jann Horn <jannh at google.com>
> Suggested-by: Christian Brauner <brauner at kernel.org>
> Assisted-by: LLM
> Signed-off-by: Chen Linxuan <me at black-desk.cn>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261010-pidfd-get-paths-v3-0-f245440b2b30@black-desk.cn?part=1