Re: [PATCH] nat: linux-namespaces: Also enter user namespace

[Benjamin Berg <benjamin@sipsolutions.net>]

On Tue, 2023-09-19 at 12:45 -0600, Tom Tromey wrote:
> > > > > 
> > From: Benjamin Berg <benjamin@sipsolutions.net>
> > The use of user namespaces is required for normal users to use mount
> > namespaces. Also entering the user namespace means that a normal user
> > can debug processes created that way.
> 
> I was going through my email backlog and didn't see a reply to this.
> 
> I don't know anything about mount namespaces.  How would one test this
> patch?  Is it possible to modify some existing test to exercise the new
> code?

You can easily reproduce it by starting a target process as normal user
using:

$ unshare --mount -r target-process

Then, simply try to attach GDB to i. Without the patch, GDB will not be
able to enter the mount namespace unless it is run using e.g. "sudo"
instead of the original user (in the same way as "unshare --mount"
without "-r" will not work for the normal user). With the patch it will
succeed.

The patch works great for me solving my namespaces problem, but I never
checked if there is a test case that could be modified/extended. If
there is a test case, then it would likely already exercise the new
code path and I would also expect such a test to fail already if run as
a non-root user.

Benjamin