Add support for creating a mount namespace that contains only a copy of the root mount from the caller's mount namespace, with none of the child mounts. This is useful for containers and sandboxes that want to start with a minimal mount table and populate it from scratch rather than inheriting and then tearing down the full mount tree. Two new flags are introduced: - CLONE_EMPTY_MNTNS for clone3(), using the 64-bit flag space. - UNSHARE_EMPTY_MNTNS for unshare(), reusing the CLONE_PARENT_SETTID bit which has no meaning for unshare. Both flags imply CLONE_NEWNS. For the unshare path, UNSHARE_EMPTY_MNTNS is converted to CLONE_EMPTY_MNTNS in unshare_nsproxy_namespaces() before it reaches copy_mnt_ns(), so the mount namespace code only needs to handle a single flag. In copy_mnt_ns(), when CLONE_EMPTY_MNTNS is set, clone_mnt() is used instead of copy_tree() to clone only the root mount. The caller's root and working directory are both reset to the root dentry of the new mount. The cleanup variables are changed from vfsmount pointers with __free(mntput) to struct path with __free(path_put) because the empty mount namespace path needs to release both mount and dentry references when replacing the caller's root and pwd. In the normal (non-empty) path only the mount component is set, and dput(NULL) is a no-op so path_put remains correct there as well.
Showing the changes to include/uapi (1 of 4 files). Show all
Unified · Split
| @@ -36,6 +36,7 @@ · 35 unmodified lines | |||
| 36 | /* Flags for the clone3() syscall. */ | 36 | /* Flags for the clone3() syscall. */ |
| 37 | #define CLONE_CLEAR_SIGHAND 0x100000000ULL /* Clear any signal handler and reset to SIG_DFL. */ | 37 | #define CLONE_CLEAR_SIGHAND 0x100000000ULL /* Clear any signal handler and reset to SIG_DFL. */ |
| 38 | #define CLONE_INTO_CGROUP 0x200000000ULL /* Clone into a specific cgroup given the right permissions. */ | 38 | #define CLONE_INTO_CGROUP 0x200000000ULL /* Clone into a specific cgroup given the right permissions. */ |
| 39 | #define CLONE_EMPTY_MNTNS (1ULL << 37) /* Create an empty mount namespace. */ | ||
| 39 | 40 | ||
| 40 | /* | 41 | /* |
| 41 | * cloning flags intersect with CSIGNAL so can be used with unshare and clone3 | 42 | * cloning flags intersect with CSIGNAL so can be used with unshare and clone3 |
| @@ -43,6 +44,12 @@ · 1 unmodified line | |||
| 43 | */ | 44 | */ |
| 44 | #define CLONE_NEWTIME 0x00000080 /* New time namespace */ | 45 | #define CLONE_NEWTIME 0x00000080 /* New time namespace */ |
| 45 | 46 | ||
| 47 | /* | ||
| 48 | * unshare flags share the bit space with clone flags but only apply to the | ||
| 49 | * unshare syscall: | ||
| 50 | */ | ||
| 51 | #define UNSHARE_EMPTY_MNTNS 0x00100000 /* Unshare an empty mount namespace. */ | ||
| 52 | |||
| 46 | #ifndef __ASSEMBLY__ | 53 | #ifndef __ASSEMBLY__ |
| 47 | /** | 54 | /** |
| 48 | * struct clone_args - arguments for the clone3 syscall | 55 | * struct clone_args - arguments for the clone3 syscall |