[PATCH] man/man5/proc_pid.5: Clarify which user namespace affects permissions

[PATCH] man/man5/proc_pid.5: Clarify which user namespace affects permissions

[Vivian Wang]

A more careful reading of fs/proc/base.c (since v4.11, as of v7.0-rc1)
reveals that it is not task->cred->user_ns that is checked, but
task->mm->user_ns, which is set during execve(2) (and copied over in
fork(2) and so on) [1], and is the correct user namespace to check for
ptrace-related purposes. Clarify the relevant text.

[1]: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=bfedb589252c01fa505ac9f6f2a3d5d68d707ef4

Fixes: ae636827 ("proc.5: Fix description of /proc/PID/* ownership to account for user namespaces")
Signed-off-by: Vivian Wang <dramforever@live.com>
---
 man/man5/proc_pid.5 | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/man/man5/proc_pid.5 b/man/man5/proc_pid.5
index eac97fa1d..2fe35bd09 100644
--- a/man/man5/proc_pid.5
+++ b/man/man5/proc_pid.5
@@ -30,7 +30,9 @@ Before Linux 4.11,
 meant the "global" root user ID and group ID
 (i.e., UID 0 and GID 0 in the initial user namespace).
 Since Linux 4.11,
-if the process is in a noninitial user namespace that has a
+if when the last time the process called
+.BR execve (2),
+it was in a noninitial user namespace that has a
 valid mapping for user (group) ID 0 inside the namespace, then
 the user (group) ownership of the files under
 .IR /proc/ pid
-- 
2.53.0

Re: [PATCH] man/man5/proc_pid.5: Clarify which user namespace affects permissions

[Alejandro Colomar]

[-- Attachment #1: Type: text/plain, Size: 1570 bytes --]

Hi Vivian,

On 2026-03-16T22:07:52+0800, Vivian Wang wrote:
> A more careful reading of fs/proc/base.c (since v4.11, as of v7.0-rc1)
> reveals that it is not task->cred->user_ns that is checked, but
> task->mm->user_ns, which is set during execve(2) (and copied over in
> fork(2) and so on) [1], and is the correct user namespace to check for
> ptrace-related purposes. Clarify the relevant text.
> 
> [1]: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=bfedb589252c01fa505ac9f6f2a3d5d68d707ef4
> 
> Fixes: ae636827 ("proc.5: Fix description of /proc/PID/* ownership to account for user namespaces")
> Signed-off-by: Vivian Wang <dramforever@live.com>

Thanks!  I've applied the patch.


Have a lovely night!
Alex

> ---
>  man/man5/proc_pid.5 | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/man/man5/proc_pid.5 b/man/man5/proc_pid.5
> index eac97fa1d..2fe35bd09 100644
> --- a/man/man5/proc_pid.5
> +++ b/man/man5/proc_pid.5
> @@ -30,7 +30,9 @@ Before Linux 4.11,
>  meant the "global" root user ID and group ID
>  (i.e., UID 0 and GID 0 in the initial user namespace).
>  Since Linux 4.11,
> -if the process is in a noninitial user namespace that has a
> +if when the last time the process called
> +.BR execve (2),
> +it was in a noninitial user namespace that has a
>  valid mapping for user (group) ID 0 inside the namespace, then
>  the user (group) ownership of the files under
>  .IR /proc/ pid
> -- 
> 2.53.0
> 
> 

-- 
<https://www.alejandro-colomar.es>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]