Re: [PATCH v3 2/2] man/man7/pid_namespaces.7: Add setns restriction and reasoning

[CC += linux-man@]

Hi Matthieu,

(You forgot to CC the list.)

On 2026-05-13T10:33:39+0200, Matthieu Buffet wrote:
> The logical implication between PID namespaces being readonly after
> process creation and process trees needing to loosely mirror PID
> namespaces is not trivial to follow. Part of that implication is
> implicit: since PID namespace membership is readonly, one has to use
> fork() or one of its variants to "change" PID namespace, and these APIs
> need to return a valid child PID in the parent namespace. The
> consequence could also be made more explicit (setns() will fail on
> non-descendant PID namespaces) while explaining how this is implemented.
> 
> Signed-off-by: Matthieu Buffet <[email protected]>

I've applied the patch.  Thanks!


Cheers,
Alex

> ---
>  man/man7/pid_namespaces.7 | 17 +++++++++++++++--
>  1 file changed, 15 insertions(+), 2 deletions(-)
> 
> diff --git a/man/man7/pid_namespaces.7 b/man/man7/pid_namespaces.7
> index b19afd505..c4a4a2723 100644
> --- a/man/man7/pid_namespaces.7
> +++ b/man/man7/pid_namespaces.7
> @@ -211,8 +211,12 @@ which would break many applications and libraries.
>  To put things another way:
>  a process's PID namespace membership is determined when the process is created
>  and cannot be changed thereafter.
> -Among other things,
> -this means that
> +.P
> +Because of this,
> +and because system calls to create a process
> +in another namespace
> +need to return a meaningful new PID
> +in the namespace of their caller,
>  the parental relationship between processes
>  loosely mirrors
>  the parental relationship between PID namespaces:
> @@ -220,6 +224,15 @@ the parent of a process
>  is either in the same namespace
>  or resides in an ancestor PID namespace
>  (immediate parent or not).
> +This is enforced by the design of
> +.BR clone (2)
> +and
> +.BR unshare (2),
> +while
> +.BR setns (2)
> +is restricted to only accept
> +the current PID namespace
> +and its descendants.
>  .P
>  A process may call
>  .BR unshare (2)
> -- 
> 2.47.3
> 

-- 
<https://www.alejandro-colomar.es>

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEES7Jt9u9GbmlWADAi64mZXMKQwqkFAmoEY3kACgkQ64mZXMKQ
wqnImhAAgMGUKCUBYSDinEAxeZx5g29KXCq4jnbGs6kchYnKpeN2qTmcQojg1wUI
mMe3uNfF4MX/UKlUQJZZvMUX9Mb6V2Jtu5y40NSd3BJxcGO+O5nhjLuunlDnHGEo
OBO65sLIx+lln6kiNrqKmTdhMQVZxjOimIjVNicS/IvK0Lxswo55yQKfyxEdJTNP
0w8/bjberpbaYdHk6Ct0UWgRF0GDxjscNgjhEypuNyUgK0+kPlGcN3ta0gv8zr1N
xMzT6s+07OySQnakM9zLsyvDQrScPJXVnzzTgTIK0miNT4sYyF2plUfzm2kdhTwk
yigvdH053qOfc2l/7wtymtNPuhlJGLrY7iWJ3EuWdRVX15kVofb5BQFlKliwKxVL
aXnEaJ7SP+LxiMzpVOnAXymwa+d4OrQadgyLM2cFmCVKvAbTIDh2nQiL45vMjMyb
9gEgaSgMB035HBHzYoWlcbrFW7nc7IdTceZ7exh6z1UvjkT73+wGMLZoZp3V8tX5
N56Zn9m59TwWCJGG8anD5nSYzkgftzxfBNcUHgaw+QVzeoQpNWgz/HAdpFpgPXw7
FORmJwpzY7ccZMKXgOnZmAefrV7AJ+fc+wt5fgpDIFNqXIYSqJwmPLQud+g2rroX
hxl+bwudfz/c2mOY9B4Kiw0q0l5+70ybiXt3NfD0jJaK+EseZoM=
=tPwq
-----END PGP SIGNATURE-----