1*4882a593Smuzhiyun // SPDX-License-Identifier: GPL-2.0
2*4882a593Smuzhiyun #define _GNU_SOURCE
3*4882a593Smuzhiyun #include <sched.h>
4*4882a593Smuzhiyun #include <unistd.h>
5*4882a593Smuzhiyun #include <stdio.h>
6*4882a593Smuzhiyun #include <stdlib.h>
7*4882a593Smuzhiyun #include <signal.h>
8*4882a593Smuzhiyun #include <errno.h>
9*4882a593Smuzhiyun #include <sys/types.h>
10*4882a593Smuzhiyun #include <sys/stat.h>
11*4882a593Smuzhiyun #include <fcntl.h>
12*4882a593Smuzhiyun #include <sys/ioctl.h>
13*4882a593Smuzhiyun #include <sys/prctl.h>
14*4882a593Smuzhiyun #include <sys/wait.h>
15*4882a593Smuzhiyun
16*4882a593Smuzhiyun #define NSIO 0xb7
17*4882a593Smuzhiyun #define NS_GET_USERNS _IO(NSIO, 0x1)
18*4882a593Smuzhiyun
19*4882a593Smuzhiyun #define pr_err(fmt, ...) \
20*4882a593Smuzhiyun ({ \
21*4882a593Smuzhiyun fprintf(stderr, "%s:%d:" fmt ": %m\n", \
22*4882a593Smuzhiyun __func__, __LINE__, ##__VA_ARGS__); \
23*4882a593Smuzhiyun 1; \
24*4882a593Smuzhiyun })
25*4882a593Smuzhiyun
main(int argc,char * argvp[])26*4882a593Smuzhiyun int main(int argc, char *argvp[])
27*4882a593Smuzhiyun {
28*4882a593Smuzhiyun int pfd[2], ns, uns, init_uns;
29*4882a593Smuzhiyun struct stat st1, st2;
30*4882a593Smuzhiyun char path[128];
31*4882a593Smuzhiyun pid_t pid;
32*4882a593Smuzhiyun char c;
33*4882a593Smuzhiyun
34*4882a593Smuzhiyun if (pipe(pfd))
35*4882a593Smuzhiyun return 1;
36*4882a593Smuzhiyun
37*4882a593Smuzhiyun pid = fork();
38*4882a593Smuzhiyun if (pid < 0)
39*4882a593Smuzhiyun return pr_err("fork");
40*4882a593Smuzhiyun if (pid == 0) {
41*4882a593Smuzhiyun prctl(PR_SET_PDEATHSIG, SIGKILL);
42*4882a593Smuzhiyun if (unshare(CLONE_NEWUTS | CLONE_NEWUSER))
43*4882a593Smuzhiyun return pr_err("unshare");
44*4882a593Smuzhiyun close(pfd[0]);
45*4882a593Smuzhiyun close(pfd[1]);
46*4882a593Smuzhiyun while (1)
47*4882a593Smuzhiyun sleep(1);
48*4882a593Smuzhiyun return 0;
49*4882a593Smuzhiyun }
50*4882a593Smuzhiyun close(pfd[1]);
51*4882a593Smuzhiyun if (read(pfd[0], &c, 1) != 0)
52*4882a593Smuzhiyun return pr_err("Unable to read from pipe");
53*4882a593Smuzhiyun close(pfd[0]);
54*4882a593Smuzhiyun
55*4882a593Smuzhiyun snprintf(path, sizeof(path), "/proc/%d/ns/uts", pid);
56*4882a593Smuzhiyun ns = open(path, O_RDONLY);
57*4882a593Smuzhiyun if (ns < 0)
58*4882a593Smuzhiyun return pr_err("Unable to open %s", path);
59*4882a593Smuzhiyun
60*4882a593Smuzhiyun uns = ioctl(ns, NS_GET_USERNS);
61*4882a593Smuzhiyun if (uns < 0)
62*4882a593Smuzhiyun return pr_err("Unable to get an owning user namespace");
63*4882a593Smuzhiyun
64*4882a593Smuzhiyun if (fstat(uns, &st1))
65*4882a593Smuzhiyun return pr_err("fstat");
66*4882a593Smuzhiyun
67*4882a593Smuzhiyun snprintf(path, sizeof(path), "/proc/%d/ns/user", pid);
68*4882a593Smuzhiyun if (stat(path, &st2))
69*4882a593Smuzhiyun return pr_err("stat");
70*4882a593Smuzhiyun
71*4882a593Smuzhiyun if (st1.st_ino != st2.st_ino)
72*4882a593Smuzhiyun return pr_err("NS_GET_USERNS returned a wrong namespace");
73*4882a593Smuzhiyun
74*4882a593Smuzhiyun init_uns = ioctl(uns, NS_GET_USERNS);
75*4882a593Smuzhiyun if (uns < 0)
76*4882a593Smuzhiyun return pr_err("Unable to get an owning user namespace");
77*4882a593Smuzhiyun
78*4882a593Smuzhiyun if (ioctl(init_uns, NS_GET_USERNS) >= 0 || errno != EPERM)
79*4882a593Smuzhiyun return pr_err("Don't get EPERM");
80*4882a593Smuzhiyun
81*4882a593Smuzhiyun if (unshare(CLONE_NEWUSER))
82*4882a593Smuzhiyun return pr_err("unshare");
83*4882a593Smuzhiyun
84*4882a593Smuzhiyun if (ioctl(ns, NS_GET_USERNS) >= 0 || errno != EPERM)
85*4882a593Smuzhiyun return pr_err("Don't get EPERM");
86*4882a593Smuzhiyun if (ioctl(init_uns, NS_GET_USERNS) >= 0 || errno != EPERM)
87*4882a593Smuzhiyun return pr_err("Don't get EPERM");
88*4882a593Smuzhiyun
89*4882a593Smuzhiyun kill(pid, SIGKILL);
90*4882a593Smuzhiyun wait(NULL);
91*4882a593Smuzhiyun return 0;
92*4882a593Smuzhiyun }
93