From 8aa97ad3a38833359511c8b5c7320e2b714b53c9 Mon Sep 17 00:00:00 2001 From: Aleksa Sarai Date: Tue, 1 Aug 2023 20:30:53 +1000 Subject: [PATCH] nsexec: remove cgroupns special-casing The original implementation of cgroupns had additional synchronisation to "ensure" that the process is in the correct cgroup before unsharing the cgroupns. This behaviour was actually never necessary, and after commit 5110bd2fc026 ("nsenter: remove cgroupns sync mechanism") there is no synchronisation at all, meaning that CLONE_NEWCGROUP should not get any special treatment. Fixes: 5110bd2fc026 ("nsenter: remove cgroupns sync mechanism") Fixes: df3fa115f974 ("Add support for cgroup namespace") Signed-off-by: Aleksa Sarai --- libcontainer/nsenter/nsexec.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/libcontainer/nsenter/nsexec.c b/libcontainer/nsenter/nsexec.c index 07d9e0df1..17e0468c6 100644 --- a/libcontainer/nsenter/nsexec.c +++ b/libcontainer/nsenter/nsexec.c @@ -1171,7 +1171,7 @@ void nsexec(void) * some old kernel versions where clone(CLONE_PARENT | CLONE_NEWPID) * was broken, so we'll just do it the long way anyway. */ - try_unshare(config.cloneflags & ~CLONE_NEWCGROUP, "remaining namespaces (except cgroupns)"); + try_unshare(config.cloneflags, "remaining namespaces"); update_timens_offsets(config.timensoffset, config.timensoffset_len); /* Ask our parent to send the mount sources fds. */ @@ -1302,10 +1302,6 @@ void nsexec(void) bail("setgroups failed"); } - if (config.cloneflags & CLONE_NEWCGROUP) { - try_unshare(CLONE_NEWCGROUP, "cgroup namespace"); - } - write_log(DEBUG, "signal completion to stage-0"); s = SYNC_CHILD_FINISH; if (write(syncfd, &s, sizeof(s)) != sizeof(s))