Add FSMOUNT_NAMESPACE flag to fsmount() that creates a new mount namespace with the newly created filesystem attached to a copy of the real rootfs. This returns a namespace file descriptor instead of an O_PATH mount fd, similar to how OPEN_TREE_NAMESPACE works for open_tree(). This allows creating a new filesystem and immediately placing it in a new mount namespace in a single operation, which is useful for container runtimes and other namespace-based isolation mechanisms. The rootfs mount is created before copying the real rootfs for the new namespace meaning that the mount namespace id for the mount of the root of the namespace is bigger than the child mounted on top of it. We've never explicitly given the guarantee for such ordering and I doubt anyone relies on it. Accepting that lets us avoid copying the mount again and also avoids having to massage may_copy_tree() to grant an exception for fsmount->mnt->mnt_ns being NULL.
Showing the changes to include/uapi (1 of 2 files). Show all
Unified · Split
| @@ -110,6 +110,7 @@ enum fsconfig_command { · 109 unmodified lines | ||
| 110 | 110 | * fsmount() flags. |
| 111 | 111 | */ |
| 112 | 112 | #define FSMOUNT_CLOEXEC 0x00000001 |
| 113 | +#define FSMOUNT_NAMESPACE 0x00000002 /* Create the mount in a new mount namespace */ | |
| 113 | 114 | |
| 114 | 115 | /* |
| 115 | 116 | * Mount attributes. |