OLD | NEW |
(Empty) | |
| 1 The [LinuxSUIDSandbox](LinuxSUIDSandbox.md) currently relies on support for the
CLONE\_NEWPID flag in Linux's [clone() system call](http://www.kernel.org/doc/ma
n-pages/online/pages/man2/clone.2.html). You can check whether your system supp
orts PID namespaces with the code below, which must be run as root: |
| 2 |
| 3 ``` |
| 4 #define _GNU_SOURCE |
| 5 #include <unistd.h> |
| 6 #include <sched.h> |
| 7 #include <stdio.h> |
| 8 #include <sys/wait.h> |
| 9 |
| 10 #if !defined(CLONE_NEWPID) |
| 11 #define CLONE_NEWPID 0x20000000 |
| 12 #endif |
| 13 |
| 14 int worker(void* arg) { |
| 15 const pid_t pid = getpid(); |
| 16 if (pid == 1) { |
| 17 printf("PID namespaces are working\n"); |
| 18 } else { |
| 19 printf("PID namespaces ARE NOT working. Child pid: %d\n", pid); |
| 20 } |
| 21 |
| 22 return 0; |
| 23 } |
| 24 |
| 25 int main() { |
| 26 if (getuid()) { |
| 27 fprintf(stderr, "Must be run as root.\n"); |
| 28 return 1; |
| 29 } |
| 30 |
| 31 char stack[8192]; |
| 32 const pid_t child = clone(worker, stack + sizeof(stack), CLONE_NEWPID, NULL); |
| 33 if (child == -1) { |
| 34 perror("clone"); |
| 35 fprintf(stderr, "Clone failed. PID namespaces ARE NOT supported\n"); |
| 36 } |
| 37 |
| 38 waitpid(child, NULL, 0); |
| 39 |
| 40 return 0; |
| 41 } |
| 42 ``` |
OLD | NEW |