From: Chen Linxuan <[email protected]> pidfds can cross pid namespace boundaries: a task may obtain one for a process outside of its own pid namespace hierarchy through SO_PASSPIDFD or SO_PEERPIDFD, via SCM_RIGHTS, or through file descriptor inheritance.
The namespace ioctls gate access with a ptrace check against the target's credentials only. That check does not account for the pid namespace relationship between the caller and the target, so a task inside a pid namespace can use a pidfd obtained across that boundary to acquire namespace file descriptors of a task outside of its hierarchy. procfs exposes the equivalent information only for tasks visible in the reader's pid namespace, and PIDFD_GET_INFO already answers with -EREMOTE for targets outside the caller's hierarchy. Extend that policy to the namespace ioctls: fail with -EREMOTE unless the target is visible in the caller's active pid namespace. Callers in ancestor pid namespaces are unaffected. Unlike PIDFD_GET_INFO, the visibility check is performed after the task lookup here, so reaped targets outside of the caller's pid namespace hierarchy answer -ESRCH instead of -EREMOTE. Link: https://lore.kernel.org/all/cag48ez1t5-tuhvk_ihsgutwa-invdrzxa3e-zcw0ienjvas...@mail.gmail.com Link: https://lore.kernel.org/all/20260925-gewischt-auftrag-tierzucht-c153cb3f9f74@brauner Suggested-by: Jann Horn <[email protected]> Suggested-by: Christian Brauner <[email protected]> Assisted-by: LLM Signed-off-by: Chen Linxuan <[email protected]> --- fs/pidfs.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/fs/pidfs.c b/fs/pidfs.c index a6a643f15d08..791f7efceabe 100644 --- a/fs/pidfs.c +++ b/fs/pidfs.c @@ -556,6 +556,14 @@ static long pidfd_ioctl(struct file *file, unsigned int cmd, unsigned long arg) if (arg) return -EINVAL; + /* + * Require the target to be visible in the caller's pid namespace + * for operations that grant access to its resources, mirroring + * procfs and PIDFD_GET_INFO. + */ + if (!pid_in_current_pidns(pidfd_pid(file))) + return -EREMOTE; + /* * We're trying to open a file descriptor to the namespace so perform a * filesystem cred ptrace check. Hold @task's exec_update_lock for the -- 2.55.0
