Obtaining a target task's executable, working directory, or root currently requires walking procfs symlinks such as /proc/<pid>/exe, /proc/<pid>/cwd, and /proc/<pid>/root. That makes the operation depend on procfs being mounted and visible to the caller, even when it already holds a pidfd for the target.
This series adds PIDFD_GET_EXE, PIDFD_GET_CWD, and PIDFD_GET_ROOT. Each ioctl takes no argument and returns a close-on-exec O_PATH file descriptor referencing the corresponding task path. The new ioctls use the same ptrace permission check and nonzero-argument rejection as the existing pidfd namespace ioctls. The target task is sampled while holding its exec_update_lock. This keeps the access decision and the task-state read in the same exec critical section, preventing a concurrent execve() from changing the credentials or target state between the check and the use. Since pidfds can cross pid namespace boundaries, the first patch restricts the existing namespace ioctls to targets visible in the caller's active pid namespace, failing with -EREMOTE like PIDFD_GET_INFO. The second patch factors out helpers for acquiring referenced task paths and reuses them in procfs and AppArmor. The third patch introduces scoped cleanup for privileged pidfd task access, carries the visibility check into the shared task acquisition helper, and separates namespace lookup from namespace fd creation. The final patch uses these pieces to implement the three new ioctls. --- Changes in v3: - Restrict the pidfd task access ioctls to targets visible in the caller's pid namespace, failing with -EREMOTE consistent with PIDFD_GET_INFO, following review feedback from Jann Horn and Christian Brauner. - Document that get_task_exe_path() leaves the output path unchanged on failure, as suggested by Jann Horn. - Link to v2: https://patch.msgid.link/[email protected] Changes in v2: - Make pidfd_get_task_locked() own the task reference until it is transferred to the pidfd_task_locked cleanup class. - Link to v1: https://patch.msgid.link/[email protected] To: Alexander Viro <[email protected]> To: Christian Brauner <[email protected]> To: Jan Kara <[email protected]> To: Andrew Morton <[email protected]> To: David Hildenbrand <[email protected]> To: Lorenzo Stoakes <[email protected]> To: "Liam R. Howlett" <[email protected]> To: Vlastimil Babka <[email protected]> To: Mike Rapoport <[email protected]> To: Suren Baghdasaryan <[email protected]> To: Michal Hocko <[email protected]> To: Ingo Molnar <[email protected]> To: Peter Zijlstra <[email protected]> To: Juri Lelli <[email protected]> To: Vincent Guittot <[email protected]> To: Dietmar Eggemann <[email protected]> To: Steven Rostedt <[email protected]> To: Ben Segall <[email protected]> To: Mel Gorman <[email protected]> To: Valentin Schneider <[email protected]> To: K Prateek Nayak <[email protected]> To: Kees Cook <[email protected]> To: John Johansen <[email protected]> To: Georgia Garcia <[email protected]> To: Paul Moore <[email protected]> To: James Morris <[email protected]> To: "Serge E. Hallyn" <[email protected]> To: Jann Horn <[email protected]> Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] --- Chen Linxuan (4): pidfd: restrict task access ioctls to the caller's pid namespace fs: Introduce task path helpers pidfd: Use scoped cleanup for task access pidfd: Add task path ioctls fs/fs_struct.c | 44 +++++++++++++ fs/pidfs.c | 158 +++++++++++++++++++++++++++++++++------------ fs/proc/base.c | 34 +--------- include/linux/fs_struct.h | 3 + include/linux/mm.h | 1 + include/uapi/linux/pidfd.h | 7 ++ kernel/fork.c | 22 +++++++ security/apparmor/task.c | 12 +--- 8 files changed, 198 insertions(+), 83 deletions(-) --- base-commit: cee9395acd8043be0644b25c34bfa86623f2b935 change-id: 20260819-pidfd-get-paths-59640d8cd1ee Best regards, -- Chen Linxuan <[email protected]>
