The main motivation to add set_tid to clone3() is CRIU. To restore a process with the same PID/TID CRIU currently uses /proc/sys/kernel/ns_last_pid. It writes the desired (PID - 1) to ns_last_pid and then (quickly) does a clone(). This works most of the time, but it is racy. It is also slow as it requires multiple syscalls. Extending clone3() to support *set_tid makes it possible restore a process using CRIU without accessing /proc/sys/kernel/ns_last_pid and race free (as long as the desired PID/TID is available). This clone3() extension places the same restrictions (CAP_SYS_ADMIN) on clone3() with *set_tid as they are currently in place for ns_last_pid. The original version of this change was using a single value for set_tid. At the 2019 LPC, after presenting set_tid, it was, however, decided to change set_tid to an array to enable setting the PID of a process in multiple PID namespaces at the same time. If a process is created in a PID namespace it is possible to influence the PID inside and outside of the PID namespace. Details also in the corresponding selftest. To create a process with the following PIDs: PID NS level Requested PID 0 (host) 31496 1 42 2 1 For that example the two newly introduced parameters to struct clone_args (set_tid and set_tid_size) would need to be: set_tid[0] = 1; set_tid[1] = 42; set_tid[2] = 31496; set_tid_size = 3; If only the PIDs of the two innermost nested PID namespaces should be defined it would look like this: set_tid[0] = 1; set_tid[1] = 42; set_tid_size = 2; The PID of the newly created process would then be the next available free PID in the PID namespace level 0 (host) and 42 in the PID namespace at level 1 and the PID of the process in the innermost PID namespace would be 1. The set_tid array is used to specify the PID of a process starting from the innermost nested PID namespaces up to set_tid_size PID namespaces. set_tid_size cannot be larger then the current PID namespace level.
Showing the changes to include/uapi/linux (1 of 7 files). Show all
Unified · Split
| @@ -39,24 +39,38 @@ · 38 unmodified lines | ||
| 39 | 39 | #ifndef __ASSEMBLY__ |
| 40 | 40 | /** |
| 41 | 41 | * struct clone_args - arguments for the clone3 syscall |
| 42 | − * @flags: Flags for the new process as listed above. | |
| 43 | − * All flags are valid except for CSIGNAL and | |
| 44 | − * CLONE_DETACHED. | |
| 45 | − * @pidfd: If CLONE_PIDFD is set, a pidfd will be | |
| 46 | − * returned in this argument. | |
| 47 | − * @child_tid: If CLONE_CHILD_SETTID is set, the TID of the | |
| 48 | − * child process will be returned in the child's | |
| 49 | − * memory. | |
| 50 | − * @parent_tid: If CLONE_PARENT_SETTID is set, the TID of | |
| 51 | − * the child process will be returned in the | |
| 52 | − * parent's memory. | |
| 53 | − * @exit_signal: The exit_signal the parent process will be | |
| 54 | − * sent when the child exits. | |
| 55 | − * @stack: Specify the location of the stack for the | |
| 56 | − * child process. | |
| 57 | − * @stack_size: The size of the stack for the child process. | |
| 58 | − * @tls: If CLONE_SETTLS is set, the tls descriptor | |
| 59 | − * is set to tls. | |
| 42 | + * @flags: Flags for the new process as listed above. | |
| 43 | + * All flags are valid except for CSIGNAL and | |
| 44 | + * CLONE_DETACHED. | |
| 45 | + * @pidfd: If CLONE_PIDFD is set, a pidfd will be | |
| 46 | + * returned in this argument. | |
| 47 | + * @child_tid: If CLONE_CHILD_SETTID is set, the TID of the | |
| 48 | + * child process will be returned in the child's | |
| 49 | + * memory. | |
| 50 | + * @parent_tid: If CLONE_PARENT_SETTID is set, the TID of | |
| 51 | + * the child process will be returned in the | |
| 52 | + * parent's memory. | |
| 53 | + * @exit_signal: The exit_signal the parent process will be | |
| 54 | + * sent when the child exits. | |
| 55 | + * @stack: Specify the location of the stack for the | |
| 56 | + * child process. | |
| 57 | + * @stack_size: The size of the stack for the child process. | |
| 58 | + * @tls: If CLONE_SETTLS is set, the tls descriptor | |
| 59 | + * is set to tls. | |
| 60 | + * @set_tid: Pointer to an array of type *pid_t. The size | |
| 61 | + * of the array is defined using @set_tid_size. | |
| 62 | + * This array is used to select PIDs/TIDs for | |
| 63 | + * newly created processes. The first element in | |
| 64 | + * this defines the PID in the most nested PID | |
| 65 | + * namespace. Each additional element in the array | |
| 66 | + * defines the PID in the parent PID namespace of | |
| 67 | + * the original PID namespace. If the array has | |
| 68 | + * less entries than the number of currently | |
| 69 | + * nested PID namespaces only the PIDs in the | |
| 70 | + * corresponding namespaces are set. | |
| 71 | + * @set_tid_size: This defines the size of the array referenced | |
| 72 | + * in @set_tid. This cannot be larger than the | |
| 73 | + * kernel's limit of nested PID namespaces. | |
| 60 | 74 | * |
| 61 | 75 | * The structure is versioned by size and thus extensible. |
| 62 | 76 | * New struct members must go at the end of the struct and |
| @@ -71,10 +85,13 @@ struct clone_args { · 8 unmodified lines | ||
| 71 | 85 | __aligned_u64 stack; |
| 72 | 86 | __aligned_u64 stack_size; |
| 73 | 87 | __aligned_u64 tls; |
| 88 | + __aligned_u64 set_tid; | |
| 89 | + __aligned_u64 set_tid_size; | |
| 74 | 90 | }; |
| 75 | 91 | #endif |
| 76 | 92 | |
| 77 | 93 | #define CLONE_ARGS_SIZE_VER0 64 /* sizeof first published struct */ |
| 94 | +#define CLONE_ARGS_SIZE_VER1 80 /* sizeof second published struct */ | |
| 78 | 95 | |
| 79 | 96 | /* |
| 80 | 97 | * Scheduling policies |