Thanks for patching this :) Guess I will find a different rabbit in a hat to detect if running in a pid namespace ;)
On Mon, Aug 7, 2017 at 4:44 AM, Peter Zijlstra <pet...@infradead.org> wrote: > On Sun, Aug 06, 2017 at 02:41:41PM +1000, Aleksa Sarai wrote: >> It appears as though the addition of the PID namespace did not update >> the output code for /proc/*/sched, which resulted in it providing PIDs >> that were not self-consistent with the /proc mount. This additionally >> made it trivial to detect whether a process was inside &init_pid_ns from >> userspace (making container detection trivial[1]). This lead to >> situations such as: >> >> % unshare -pmf >> % mount -t proc proc /proc >> % head -n1 /proc/1/sched >> head (10047, #threads: 1) >> >> Fix this by just using task_pid_nr_ns for the output of /proc/*/sched. >> All of the other uses of task_pid_nr in kernel/sched/debug.c are from a >> sysctl context and thus don't need to be namespaced. >> >> [1]: https://github.com/jessfraz/amicontained >> >> Cc: <sta...@vger.kernel.org> >> Cc: Jess Frazelle <acidb...@google.com> >> Signed-off-by: Aleksa Sarai <asa...@suse.com> > > Thanks!
smime.p7s
Description: S/MIME Cryptographic Signature
