jasder
/
runc
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Merge pull request #1168 from hqhq/fix_nsexec_comments 

More fix to nsexec.c's comments
This commit is contained in:
Mrunal Patel 2016-11-07 16:20:42 -07:00 committed by GitHub
parent 99a60237cd 84a4218ece
commit 8779fa57eb
1 changed files with 14 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
libcontainer/nsenter/nsexec.c
View File

@ -598,11 +598,11 @@ void nsexec(void)
/*
* Stage 1: We're in the first child process. Our job is to join any
* provided user namespaces in the netlink payload. If we've been
* asked to CLONE_NEWUSER, we will unshare the user namespace and
* ask our parent (stage 0) to set up our user mappings for us.
* Then, we unshare the rest of the requested namespaces and
* create a new child (stage 2: JUMP_INIT). We then send the
* provided namespaces in the netlink payload and unshare all
* of the requested namespaces. If we've been asked to
* CLONE_NEWUSER, we will ask our parent (stage 0) to set up
* our user mappings for us. Then, we create a new child
* (stage 2: JUMP_INIT) for PID namespace. We then send the
* child's PID to our parent (stage 0).
*/
case JUMP_CHILD: {
@ -660,7 +660,15 @@ void nsexec(void)
bail("failed to sync with parent: SYNC_USERMAP_ACK: got %u", s);
}
/* TODO: What about non-namespace clone flags that we're dropping here? */
/*
* TODO: What about non-namespace clone flags that we're dropping here?
*
* We fork again because of PID namespace, setns(2) or unshare(2) don't
* change the PID namespace of the calling process, because doing so
* would change the caller's idea of its own PID (as reported by getpid()),
* which would break many applications and libraries, so we must fork
* to actually enter the new PID namespace.
*/
child = clone_parent(&env, JUMP_INIT);
if (child < 0)
bail("unable to fork: init_func");