From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=none (p=none dis=none) header.from=gibson.dropbear.id.au Authentication-Results: passt.top; dkim=pass (2048-bit key; secure) header.d=gibson.dropbear.id.au header.i=@gibson.dropbear.id.au header.a=rsa-sha256 header.s=202608 header.b=KzqNnigH; dkim-atps=neutral Received: from mail.ozlabs.org (mail.ozlabs.org [IPv6:2404:9400:2221:ea00::3]) by passt.top (Postfix) with ESMTPS id EC6C15A026E for ; Tue, 08 Sep 2026 08:03:18 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gibson.dropbear.id.au; s=202608; t=1788847386; bh=pXePTeKkC/kVjwu0wLlHMGmTaT/dTFP+GAJ5lUDsUno=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=KzqNnigHquUVdwH6PzwoxHX9vJbja8pJrGinc1S4M3p7ywKVBHXTeY7iNyKMIoqu+ GqkPZZYlKWP2NRS008z56tTFZB+dP8SCRmilb7k00q/C8D/bLVyLludIIiwd1GRcF2 5Lewto8yyjs+sXT9ADzfbsj3oBpAMaZwLRpswAe7AW+37RSHcRUZu7BKUZhQw8kDnQ LEiO18hmjlq/beOAt4IYo1Je+6vTsvwGioK8pcXGNbiqfI5leq/nzsCXOKtwHglJ2b hrzAJKi2/28WMcHgS6SB4ILB9okecV2wYNo8W+XYqGUH8FuWFG/973x+FTas3SnjFb 6UQBdeemjDGPw== Received: by gandalf.ozlabs.org (Postfix, from userid 1007) id 4hfCzG2h0lz4w9W; Tue, 08 Sep 2026 16:03:06 +1000 (AEST) Date: Tue, 8 Sep 2026 16:03:07 +1000 From: David Gibson To: Christian Korneck Subject: Re: [PATCH] pasta: Add --no-pidns to keep spawned command in caller's PID namespace Message-ID: References: <20260906131758.121019-1-christian@korneck.de> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="Z8nLSMvXMudOw5+F" Content-Disposition: inline In-Reply-To: <20260906131758.121019-1-christian@korneck.de> Message-ID-Hash: H3E7BIBTKAZTWRUE6XOPEMHOUWIAUTEZ X-Message-ID-Hash: H3E7BIBTKAZTWRUE6XOPEMHOUWIAUTEZ X-MailFrom: dgibson@gandalf.ozlabs.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: passt-dev@passt.top X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: --Z8nLSMvXMudOw5+F Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Sun, Sep 06, 2026 at 03:17:58PM +0200, Christian Korneck wrote: > This is to allow running pasta inside a container without unmasking > /proc for the whole container (Docker's --security-opt > systempaths=3Dunconfined, Podman's --security-opt unmask=3DALL), which is > undesirable as it exposes /proc/sysrq-trigger and other masked paths. >=20 > In spawn mode, pasta clones the command with CLONE_NEWPID and mounts a > new procfs instance on /proc, so that it matches the new PID namespace. >=20 > Mounting procfs in a new user namespace requires a fully visible, > unobstructed procfs. Container runtimes deliberately obstruct /proc > (Docker, for example, masks /proc/kcore and friends and mounts > /proc/sys read-only), so the mount is refused: >=20 > Couldn't mount /proc: Operation not permitted >=20 > We only warn and continue, leaving the command in a new PID namespace > while the visible /proc still numbers processes in the outer one. > Anything resolving its own PID through /proc then fails, for example > bubblewrap: >=20 > bwrap: open /proc/22/ns/ns failed: No such file or directory >=20 > Add a --no-pidns option: skip CLONE_NEWPID for the spawned command and > don't mount /proc, which is then not needed. User, network, mount, UTS > and IPC namespaces, --config-net and port forwarding are unaffected. > The option is rejected together with PID or --netns, as it only makes > sense when we spawn the command ourselves. >=20 > Add a test checking that, by default, the command runs in a new PID > namespace, and that --no-pidns keeps it in the caller's one. I can see that this would be useful. On the other hand, I could say that for just about any combinatiom of unshare(1) options, and I don't think we want to reimplement all of unshare(1) in pasta. Note that it is always possible to create a namespace using unshare(1) with arbitrary options and then connect it with pasta, rather than having pasta create its own. That said, I've never seen the point of creating a pidns by default in pasta. We're not isolating the filesystem, so I don't see that there's much to gain by isolating pids. I'd be happy enough to see CLONE_NEWPID removed unconditionally. >=20 > Signed-off-by: Christian Korneck > --- > conf.c | 11 +++++++++++ > passt.1 | 12 ++++++++++++ > passt.h | 2 ++ > pasta.c | 18 +++++++++++------- > test/pasta_options/no_pidns | 25 +++++++++++++++++++++++++ > test/run | 1 + > 6 files changed, 62 insertions(+), 7 deletions(-) > create mode 100644 test/pasta_options/no_pidns >=20 > diff --git a/conf.c b/conf.c > index faf2681..16b2f40 100644 > --- a/conf.c > +++ b/conf.c > @@ -742,6 +742,7 @@ pasta_opts: > " implied if PATH or NAME are given without --userns\n" > " --no-netns-quit Don't quit if filesystem-bound target\n" > " network namespace is deleted\n" > + " --no-pidns Don't spawn command in a new PID namespace\n" > " --config-net Configure tap interface in namespace\n" > " --no-copy-routes DEPRECATED:\n" > " Don't copy all routes to namespace\n" > @@ -1348,6 +1349,7 @@ void conf(struct ctx *c, int argc, char **argv) > {"stats", required_argument, NULL, 31 }, > {"conf-path", required_argument, NULL, 'c' }, > {"chroot-fallback", no_argument, NULL, 32 }, > + {"no-pidns", no_argument, NULL, 33 }, > { 0 }, > }; > const char *optstring =3D "+dqfel:hs:c:F:I:p:P:m:a:n:M:g:i:o:D:S:H:461t= :u:T:U:"; > @@ -1589,6 +1591,12 @@ void conf(struct ctx *c, int argc, char **argv) > case 32: > c->chroot_fallback =3D true; > break; > + case 33: > + if (c->mode !=3D MODE_PASTA) > + die("--no-pidns is for pasta mode only"); > + > + c->no_pidns =3D true; > + break; > case 'd': > c->debug =3D 1; > c->quiet =3D 0; > @@ -1948,6 +1956,9 @@ void conf(struct ctx *c, int argc, char **argv) > else if (optind !=3D argc) > die("Extra non-option argument: %s", argv[optind]); > =20 > + if (c->no_pidns && *netns) > + die("--no-pidns is incompatible with PID or --netns"); > + > conf_open_files(c); /* Before any possible setuid() / setgid() */ > =20 > isolate_user(c, uid, gid, !netns_only, userns); > diff --git a/passt.1 b/passt.1 > index 53e072a..0b780fe 100644 > --- a/passt.1 > +++ b/passt.1 > @@ -704,6 +704,18 @@ is bound to the filesystem, and the given path is de= leted, or if the target > network namespace is represented by a procfs entry, and that entry is de= leted, > representing the fact that a process with the given PID terminated. > =20 > +.TP > +.BR \-\-no-pidns > +Don't create a new PID namespace for the spawned command or shell: keep = it in > +the PID namespace \fBpasta\fR itself runs in, and don't mount a new > +\fIprocfs\fR instance on \fI/proc\fR for it. This is useful in environme= nts > +where mounting \fIprocfs\fR is not permitted, such as containers, where = the > +command would otherwise get a \fI/proc\fR view that doesn't match its ow= n PID > +namespace. Note that, without a PID namespace, processes started by the > +command are not terminated once the command exits. > + > +This option can't be specified with a PID or with \-\-netns. > + > .TP > .BR \-\-config-net > Configure networking in the namespace: set up addresses and routes as co= nfigured > diff --git a/passt.h b/passt.h > index 51ccd4f..afd8e9f 100644 > --- a/passt.h > +++ b/passt.h > @@ -195,6 +195,7 @@ struct ip6_ctx { > * @pasta_ifn: Name of namespace interface for pasta > * @pasta_ifi: Index of namespace interface for pasta > * @pasta_conf_ns: Configure namespace after creating it > + * @no_pidns: Don't create a new PID namespace for spawned command > * @fwd: Forwarding tables > * @fwd_pending: Pending forward tables > * @no_tcp: Disable TCP operation > @@ -278,6 +279,7 @@ struct ctx { > char pasta_ifn[IF_NAMESIZE]; > unsigned int pasta_ifi; > int pasta_conf_ns; > + bool no_pidns; > =20 > struct fwd_table *fwd[PIF_NUM_TYPES]; > struct fwd_table *fwd_pending[PIF_NUM_TYPES]; > diff --git a/pasta.c b/pasta.c > index 5aa56b7..2d916e1 100644 > --- a/pasta.c > +++ b/pasta.c > @@ -194,15 +194,17 @@ static int pasta_spawn_cmd(void *arg) > if (prctl(PR_SET_PDEATHSIG, SIGKILL)) > die_perror("Couldn't set PR_SET_PDEATHSIG"); > =20 > - /* We run in a detached PID and mount namespace: mount /proc over */ > - if (mount("", "/proc", "proc", 0, NULL)) > + a =3D (const struct pasta_spawn_cmd_arg *)arg; > + > + /* We run in a detached mount namespace, and, unless --no-pidns was > + * given, in a detached PID namespace: mount /proc over > + */ > + if (!a->c->no_pidns && mount("", "/proc", "proc", 0, NULL)) > warn_perror("Couldn't mount /proc"); > =20 > if (write_file("/proc/sys/net/ipv4/ping_group_range", "0 0")) > warn("Cannot set ping_group_range, ICMP requests might fail"); > =20 > - a =3D (const struct pasta_spawn_cmd_arg *)arg; > - > conf_hostname_len =3D strlen(a->c->hostname); > if (conf_hostname_len > 0) { > if (sethostname(a->c->hostname, conf_hostname_len)) > @@ -243,6 +245,7 @@ static int pasta_spawn_cmd(void *arg) > void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid, bool config_idm= aps, > int argc, char *argv[]) > { > + int flags =3D CLONE_NEWIPC | CLONE_NEWNET | CLONE_NEWUTS | CLONE_NEWNS; > char ns_fn_stack[NS_FN_STACK_SIZE] > __attribute__ ((aligned(__alignof__(max_align_t)))); > struct pasta_spawn_cmd_arg arg =3D { > @@ -293,10 +296,11 @@ void pasta_start_ns(struct ctx *c, uid_t uid, gid_t= gid, bool config_idmaps, > sigaddset(&set, SIGUSR1); > sigprocmask(SIG_BLOCK, &set, NULL); > =20 > + if (!c->no_pidns) > + flags |=3D CLONE_NEWPID; > + > pasta_child_pid =3D do_clone(pasta_spawn_cmd, ns_fn_stack, > - sizeof(ns_fn_stack), > - CLONE_NEWIPC | CLONE_NEWPID | CLONE_NEWNET | > - CLONE_NEWUTS | CLONE_NEWNS | SIGCHLD, > + sizeof(ns_fn_stack), flags | SIGCHLD, > (void *)&arg); > =20 > if (pasta_child_pid =3D=3D -1) > diff --git a/test/pasta_options/no_pidns b/test/pasta_options/no_pidns > new file mode 100644 > index 0000000..f565b2f > --- /dev/null > +++ b/test/pasta_options/no_pidns > @@ -0,0 +1,25 @@ > +# SPDX-License-Identifier: GPL-2.0-or-later > +# > +# PASST - Plug A Simple Socket Transport > +# for qemu/UNIX domain socket mode > +# > +# PASTA - Pack A Subtle Tap Abstraction > +# for network namespace/tap device mode > +# > +# test/pasta_options/no_pidns - Check --no-pidns handling > + > +htools readlink > + > +test Command is spawned in a new PID namespace by default > +set PIDNS __STATEDIR__/pidns > +set OUT __STATEDIR__/no-pidns.out > +set ERR __STATEDIR__/no-pidns.err > + > +passt readlink /proc/self/ns/pid > __PIDNS__ > +passt ./pasta -q -- readlink /proc/self/ns/pid > __OUT__ 2> __ERR__ > +check [ "$(cat __PIDNS__)" !=3D "$(cat __OUT__)" ] > + > +test --no-pidns keeps command in the caller's PID namespace > +passt ./pasta -q --no-pidns -- readlink /proc/self/ns/pid > __OUT__ 2> _= _ERR__ > +check [ "$(cat __PIDNS__)" =3D "$(cat __OUT__)" ] > +check [ ! -s __ERR__ ] > diff --git a/test/run b/test/run > index c4073cc..14ddbbf 100755 > --- a/test/run > +++ b/test/run > @@ -86,6 +86,7 @@ run() { > setup pasta_options > test pasta_options/log_to_file > test pasta_options/netns_only > + test pasta_options/no_pidns > teardown pasta_options > =20 > setup build > --=20 > 2.55.0 >=20 --=20 David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson --Z8nLSMvXMudOw5+F Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEO+dNsU4E3yXUXRK2zQJF27ox2GcFAmqfpQoACgkQzQJF27ox 2GeD9Q//Rf0hgdwYuWdnNv6XxAGmPJnjvpGE/O3pE3btXQAofWR+yWvT8oQGhbEa yaOCyRqn6FOjLcohc2NSBeGVjf4d2yF+eay12Sa+iUeuukHPmsqwNczU53CeW9W7 UIz73IwEOwXlSU5c62wGIONbuOqiUkjxQdNsQMR3G4t43dRYMDpDVFXVNy38RUEg 8dCWbnS1+M1x7NNcrWerfRYxs5uyuha7+84j4HTFPkJPKyNRxvidzcLAcOT1LkM2 ro9LLwlqBJW8gbN08pFLVzMRhCEQT68PyFm9anY7k9nL16cX3Yp0r/sV52UNngQP X0IMeSD3jlMPP0GXd6VeYSZz+I5ZuT+rdTB5E8bKq8mZ2RYBBVjybukdYLVMvExB eyANginD0ayJTfBJYM/IZPcP/0W2+vD6Uolg1Mtr1LETV+QfsY/gzMaLD7jZYxqF zjrTuoH/iGdNMvV7wZKELM3QhnEPRoQiKVfQZH+zKbMK0wwNvK8W0dr/wMiwC/G2 hhcI7N1VgD8NgVDWyNh6fHIcocC4mnl5cgh9mXRQWniS0qK+azG24+UN4XpdU5bt Nx44G1sBlwRs7nHhIxjwbkr44WjM5H0MCQS2+TYIIuGt0yZOtYo9xAaCfyNF7o/+ /Wrwu1PbA5/3CKKYBXRZCuaYWjBPYBlGWhvlHaEJg0ETxFr+Pbs= =5Enq -----END PGP SIGNATURE----- --Z8nLSMvXMudOw5+F--