The main motivation to add set_tid to clone3() is CRIU. To restore a process with the same PID/TID CRIU currently uses /proc/sys/kernel/ns_last_pid. It writes the desired (PID - 1) to ns_last_pid and then (quickly) does a clone(). This works most of the time, but it is racy. It is also slow as it requires multiple syscalls. Extending clone3() to support *set_tid makes it possible restore a process using CRIU without accessing /proc/sys/kernel/ns_last_pid and race free (as long as the desired PID/TID is available). This clone3() extension places the same restrictions (CAP_SYS_ADMIN) on clone3() with *set_tid as they are currently in place for ns_last_pid. The original version of this change was using a single value for set_tid. At the 2019 LPC, after presenting set_tid, it was, however, decided to change set_tid to an array to enable setting the PID of a process in multiple PID namespaces at the same time. If a process is created in a PID namespace it is possible to influence the PID inside and outside of the PID namespace. Details also in the corresponding selftest. To create a process with the following PIDs: PID NS level Requested PID 0 (host) 31496 1 42 2 1 For that example the two newly introduced parameters to struct clone_args (set_tid and set_tid_size) would need to be: set_tid[0] = 1; set_tid[1] = 42; set_tid[2] = 31496; set_tid_size = 3; If only the PIDs of the two innermost nested PID namespaces should be defined it would look like this: set_tid[0] = 1; set_tid[1] = 42; set_tid_size = 2; The PID of the newly created process would then be the next available free PID in the PID namespace level 0 (host) and 42 in the PID namespace at level 1 and the PID of the process in the innermost PID namespace would be 1. The set_tid array is used to specify the PID of a process starting from the innermost nested PID namespaces up to set_tid_size PID namespaces. set_tid_size cannot be larger then the current PID namespace level.
Showing the changes to include/uapi/linux (1 of 7 files). Show all
Unified · Split
| @@ -39,24 +39,38 @@ · 38 unmodified lines | |||
| 39 | #ifndef __ASSEMBLY__ | 39 | #ifndef __ASSEMBLY__ |
| 40 | /** | 40 | /** |
| 41 | * struct clone_args - arguments for the clone3 syscall | 41 | * struct clone_args - arguments for the clone3 syscall |
| 42 | * @flags: Flags for the new process as listed above. | 42 | * @flags: Flags for the new process as listed above. |
| 43 | * All flags are valid except for CSIGNAL and | 43 | * All flags are valid except for CSIGNAL and |
| 44 | * CLONE_DETACHED. | 44 | * CLONE_DETACHED. |
| 45 | * @pidfd: If CLONE_PIDFD is set, a pidfd will be | 45 | * @pidfd: If CLONE_PIDFD is set, a pidfd will be |
| 46 | * returned in this argument. | 46 | * returned in this argument. |
| 47 | * @child_tid: If CLONE_CHILD_SETTID is set, the TID of the | 47 | * @child_tid: If CLONE_CHILD_SETTID is set, the TID of the |
| 48 | * child process will be returned in the child's | 48 | * child process will be returned in the child's |
| 49 | * memory. | 49 | * memory. |
| 50 | * @parent_tid: If CLONE_PARENT_SETTID is set, the TID of | 50 | * @parent_tid: If CLONE_PARENT_SETTID is set, the TID of |
| 51 | * the child process will be returned in the | 51 | * the child process will be returned in the |
| 52 | * parent's memory. | 52 | * parent's memory. |
| 53 | * @exit_signal: The exit_signal the parent process will be | 53 | * @exit_signal: The exit_signal the parent process will be |
| 54 | * sent when the child exits. | 54 | * sent when the child exits. |
| 55 | * @stack: Specify the location of the stack for the | 55 | * @stack: Specify the location of the stack for the |
| 56 | * child process. | 56 | * child process. |
| 57 | * @stack_size: The size of the stack for the child process. | 57 | * @stack_size: The size of the stack for the child process. |
| 58 | * @tls: If CLONE_SETTLS is set, the tls descriptor | 58 | * @tls: If CLONE_SETTLS is set, the tls descriptor |
| 59 | * is set to tls. | 59 | * is set to tls. |
| 60 | * @set_tid: Pointer to an array of type *pid_t. The size | ||
| 61 | * of the array is defined using @set_tid_size. | ||
| 62 | * This array is used to select PIDs/TIDs for | ||
| 63 | * newly created processes. The first element in | ||
| 64 | * this defines the PID in the most nested PID | ||
| 65 | * namespace. Each additional element in the array | ||
| 66 | * defines the PID in the parent PID namespace of | ||
| 67 | * the original PID namespace. If the array has | ||
| 68 | * less entries than the number of currently | ||
| 69 | * nested PID namespaces only the PIDs in the | ||
| 70 | * corresponding namespaces are set. | ||
| 71 | * @set_tid_size: This defines the size of the array referenced | ||
| 72 | * in @set_tid. This cannot be larger than the | ||
| 73 | * kernel's limit of nested PID namespaces. | ||
| 60 | * | 74 | * |
| 61 | * The structure is versioned by size and thus extensible. | 75 | * The structure is versioned by size and thus extensible. |
| 62 | * New struct members must go at the end of the struct and | 76 | * New struct members must go at the end of the struct and |
| @@ -71,10 +85,13 @@ struct clone_args { · 8 unmodified lines | |||
| 71 | __aligned_u64 stack; | 85 | __aligned_u64 stack; |
| 72 | __aligned_u64 stack_size; | 86 | __aligned_u64 stack_size; |
| 73 | __aligned_u64 tls; | 87 | __aligned_u64 tls; |
| 88 | __aligned_u64 set_tid; | ||
| 89 | __aligned_u64 set_tid_size; | ||
| 74 | }; | 90 | }; |
| 75 | #endif | 91 | #endif |
| 76 | 92 | ||
| 77 | #define CLONE_ARGS_SIZE_VER0 64 /* sizeof first published struct */ | 93 | #define CLONE_ARGS_SIZE_VER0 64 /* sizeof first published struct */ |
| 94 | #define CLONE_ARGS_SIZE_VER1 80 /* sizeof second published struct */ | ||
| 78 | 95 | ||
| 79 | /* | 96 | /* |
| 80 | * Scheduling policies | 97 | * Scheduling policies |