diff mbox series

[bug#77638,6/8] syscalls: Add ‘get-user-ns’.

Message ID 97322fc8343bc3c39721725091ac855f02d7f7ec.1744114408.git.ludo@gnu.org
State New
Headers
Series Harden 'call-with-container' |

Commit Message

Ludovic Courtès April 8, 2025, 12:24 p.m. UTC 
  * guix/build/syscalls.scm (NS_GET_USERNS): New variable.
(get-user-ns): New procedure.

Change-Id: I0cfba6a7cdf2ab64ef658b0f821ba4e7c6c89eab
---
 guix/build/syscalls.scm | 14 ++++++++++++++
 1 file changed, 14 insertions(+)
diff mbox series

Patch

diff --git a/guix/build/syscalls.scm b/guix/build/syscalls.scm
index 42232fc7f1..9cb4b98908 100644
--- a/guix/build/syscalls.scm
+++ b/guix/build/syscalls.scm
@@ -146,6 +146,7 @@  (define-module (guix build syscalls)
             CLONE_NEWNET
             clone
             setns
+            get-user-ns
 
             kexec-load-file
             KEXEC_FILE_UNLOAD
@@ -1229,6 +1230,19 @@  (define setns
                   (list fdes nstype (strerror err))
                   (list err))))))))
 
+(define NS_GET_USERNS #xb701)
+
+(define (get-user-ns fdes)
+  "Return an open file descriptor to the user namespace that owns the
+namespace pointed to by FDES, a file descriptor obtained by opening
+/proc/PID/ns/*."
+  (let-values (((ret err) (%ioctl fdes NS_GET_USERNS %null-pointer)))
+    (when (< ret 0)
+      (throw 'system-error "get-user-ns" "~d: ~A"
+             (list fdes (strerror err))
+             (list err)))
+    ret))
+
 (define pivot-root
   (let ((proc (syscall->procedure int "pivot_root" (list '* '*))))
     (lambda (new-root put-old)