proc: Fix the proc access checks to namespace files.

Access to namespace files needs to be restricted with
ptrace_may_read in proc to avoid unecessary information leaks
about processes and to avoid processes that could not otherwise
extend the lifetime of a namespace from opening a namespace file
and extending that lifetime.

Add magic symlinks to the namespace files, so that we won't cache
the dentries for the namespace files in a way that can bypass the
ptrace_may_access checks.

Remove the accident of the initial implementation that made
namespace files depend on pids and tasks, and change the
namespace files to be their own entities with their own dentry
and inode operations. The new namespace dentry operations
specify a policy of not caching namespace dentries when not in
use.  Not caching unused namespace dentries makes it easy to
verify the dcache won't keep namespaces alive longer than

Change the owner of namespace files to root as derving the
ownership of namespace files from a process is no longer possible
as namespace files are no longer implemented as per process
entities.  Namespace files being read only as root is safe and
changes nothing in practice as the kernel interfaces that take
namespace file descriptors require root capabilities.

Signed-off-by: Eric W. Biederman <>
2 files changed