On Wed, Jul 23, 2025 at 09:18:51AM +1000, Aleksa Sarai wrote:
> This check will be needed in later patches, and there's no point
> open-coding it each time.
>
> Signed-off-by: Aleksa Sarai <cyp...@cyphar.com>
> ---
> include/linux/pid_namespace.h | 9 +++++++++
> kernel/pid_namespace.c | 23 +++++++++++++++--------
> 2 files changed, 24 insertions(+), 8 deletions(-)
>
> diff --git a/include/linux/pid_namespace.h b/include/linux/pid_namespace.h
> index 7c67a5811199..17fdc059f8da 100644
> --- a/include/linux/pid_namespace.h
> +++ b/include/linux/pid_namespace.h
> @@ -84,6 +84,9 @@ extern void zap_pid_ns_processes(struct pid_namespace
> *pid_ns);
> extern int reboot_pid_ns(struct pid_namespace *pid_ns, int cmd);
> extern void put_pid_ns(struct pid_namespace *ns);
>
> +extern bool pidns_is_ancestor(struct pid_namespace *child,
> + struct pid_namespace *ancestor);
> +
> #else /* !CONFIG_PID_NS */
> #include <linux/err.h>
>
> @@ -118,6 +121,12 @@ static inline int reboot_pid_ns(struct pid_namespace
> *pid_ns, int cmd)
> {
> return 0;
> }
> +
> +static inline bool pidns_is_ancestor(struct pid_namespace *child,
> + struct pid_namespace *ancestor)
> +{
> + return false;
> +}
> #endif /* CONFIG_PID_NS */
>
> extern struct pid_namespace *task_active_pid_ns(struct task_struct *tsk);
> diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c
> index 7098ed44e717..c2783c5fa90b 100644
> --- a/kernel/pid_namespace.c
> +++ b/kernel/pid_namespace.c
> @@ -390,11 +390,24 @@ static void pidns_put(struct ns_common *ns)
> put_pid_ns(to_pid_ns(ns));
> }
>
> +bool pidns_is_ancestor(struct pid_namespace *child,
> + struct pid_namespace *ancestor)
> +{
> + struct pid_namespace *ns;
> +
> + if (child->level < ancestor->level)
> + return false;
> + for (ns = child; ns->level > ancestor->level; ns = ns->parent)
> + ;
> + return ns == ancestor;
> +}
> +EXPORT_SYMBOL_GPL(pidns_is_ancestor);
Why do you need to export this? Afaict, this is only used from procfs
and iirc procfs cannot be a module. This could also be a static inline
completely in the header? Otherwise this looks good.
