From 0ef8fe22ed8985c9656835fc25ab3463d55b6669 Mon Sep 17 00:00:00 2001 From: Ludovic Courtès Date: Mon, 30 Jan 2023 22:20:18 +0100 Subject: linux-container: 'container-excursion' forks to join the PID namespace. Fixes . * gnu/build/linux-container.scm (container-excursion): Add extra call to 'primitive-fork' and invoke THUNK in the child process. * tests/containers.scm ("container-excursion"): Remove extra 'primitive-fork' call, now unnecessary. ("container-excursion*, /proc"): New test. --- gnu/build/linux-container.scm | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) (limited to 'gnu/build') diff --git a/gnu/build/linux-container.scm b/gnu/build/linux-container.scm index d11c49c0d8..dee6885400 100644 --- a/gnu/build/linux-container.scm +++ b/gnu/build/linux-container.scm @@ -1,6 +1,6 @@ ;;; GNU Guix --- Functional package management for GNU ;;; Copyright © 2015 David Thompson -;;; Copyright © 2017-2019, 2022 Ludovic Courtès +;;; Copyright © 2017-2019, 2022, 2023 Ludovic Courtès ;;; ;;; This file is part of GNU Guix. ;;; @@ -432,7 +432,16 @@ return the exit status, an integer as returned by 'waitpid'." '("user" "ipc" "uts" "net" "pid" "mnt")) (purify-environment) (chdir "/") - (thunk)))) + + ;; Per setns(2), changing the PID namespace only applies to child + ;; processes, not to the process itself. Thus fork so that THUNK runs + ;; in the right PID namespace, which also gives it access to /proc. + (match (primitive-fork) + (0 (call-with-clean-exit thunk)) + (pid (primitive-exit + (match (waitpid pid) + ((_ . status) + (or (status:exit-val status) 127))))))))) (pid (match (waitpid pid) ((_ . status) -- cgit v1.2.3