@@ -11,6 +11,7 @@
#include <linux/user_namespace.h>
#include <linux/nsfs.h>
#include <linux/uaccess.h>
+#include <net/net_namespace.h>
#include "internal.h"
@@ -191,6 +192,8 @@ static long ns_ioctl(struct file *filp, unsigned int ioctl,
struct user_namespace *user_ns;
struct ns_common *ns = get_proc_ns(file_inode(filp));
uid_t __user *argp;
+ struct net *net_ns;
+ u64 cookie;
uid_t uid;
switch (ioctl) {
@@ -209,6 +212,11 @@ static long ns_ioctl(struct file *filp, unsigned int ioctl,
argp = (uid_t __user *) arg;
uid = from_kuid_munged(current_user_ns(), user_ns->owner);
return put_user(uid, argp);
+ case NS_GET_COOKIE:
+ if (ns->ops->type != CLONE_NEWNET)
+ return -EINVAL;
+ net_ns = container_of(ns, struct net, ns);
+ return put_user(net_ns->net_cookie, (u64 __user *)arg);
default:
return -ENOTTY;
}
@@ -15,5 +15,7 @@
#define NS_GET_NSTYPE _IO(NSIO, 0x3)
/* Get owner UID (in the caller's user namespace) for a user namespace */
#define NS_GET_OWNER_UID _IO(NSIO, 0x4)
+/* Returns a unique non-zero identifier for a network namespace */
+#define NS_GET_COOKIE _IO(NSIO, 0x5)
#endif /* __LINUX_NSFS_H */
Network namespaces have a globally unique non-zero identifier aka a cookie, in line with socket cookies. Add an ioctl to retrieve the cookie from user space without going via BPF. Signed-off-by: Lorenz Bauer <lmb@cloudflare.com> --- fs/nsfs.c | 8 ++++++++ include/uapi/linux/nsfs.h | 2 ++ 2 files changed, 10 insertions(+)