Re: [PATCH container 5/8] namespaces: refactor run_in_userns

[Wolfgang Bumiller <w.bumiller@proxmox.com>]

On Mon, Feb 23, 2026 at 02:04:51PM +0100, Filip Schauer wrote:
> Signed-off-by: Filip Schauer <f.schauer@proxmox.com>
> ---
>  src/PVE/LXC/Namespaces.pm | 27 +++++++++++++++++++--------
>  1 file changed, 19 insertions(+), 8 deletions(-)
> 
> diff --git a/src/PVE/LXC/Namespaces.pm b/src/PVE/LXC/Namespaces.pm
> index 3b86262..477d0ac 100644
> --- a/src/PVE/LXC/Namespaces.pm
> +++ b/src/PVE/LXC/Namespaces.pm
> @@ -25,6 +25,19 @@ my sub set_id_map($$) {
>      PVE::Tools::run_command(['newuidmap', $pid, @uid_args]) if scalar(@uid_args);
>  }
>  
> +my sub sync_send {
> +    my ($fh, $msg) = @_;
> +
> +    syswrite($fh, $msg) == length($msg) or die "sync write failed: $!\n";

Given what we use them for and that they're private to this module, we
may as well include the $msg in the error.

> +}
> +
> +my sub sync_recv {
> +    my ($fh, $expect) = @_;
> +
> +    my $received = <$fh>;
> +    die "sync read failed\n" if $received ne $expect;

Here, too.

> +}
> +
>  sub run_in_userns($;$) {
>      my ($code, $id_map) = @_;
>      socketpair(my $sp, my $sc, AF_UNIX, SOCK_STREAM, PF_UNSPEC)
> @@ -32,25 +45,23 @@ sub run_in_userns($;$) {
>      my $child = sub {
>          close($sp);
>          PVE::Tools::unshare(CLONE_NEWUSER | CLONE_NEWNS) or die "unshare(NEWUSER|NEWNS): $!\n";
> -        syswrite($sc, "1\n") == 2 or die "write: $!\n";
> +        sync_send($sc, "1\n");
>          shutdown($sc, 1);
> -        my $two = <$sc>;
> -        die "failed to sync with parent process\n" if $two ne "2\n";
> +        sync_recv($sc, "2\n");
>          close($sc);
>          $! = undef;
>          ($(, $)) = (0, 0);
> -        die "$!\n" if $!;
> +        die "setgid(0): $!\n" if $!;
>          ($<, $>) = (0, 0);
> -        die "$!\n" if $!;
> +        die "setuid(0): $!\n" if $!;
>          return $code->();
>      };
>      my $parent = sub {
>          my ($pid) = @_;
>          close($sc);
> -        my $one = <$sp>;
> -        die "failed to sync with userprocess\n" if $one ne "1\n";
> +        sync_recv($sp, "1\n");
>          set_id_map($pid, $id_map);
> -        syswrite($sp, "2\n") == 2 or die "write: $!\n";
> +        sync_send($sp, "2\n");
>          close($sp);
>      };
>      PVE::Tools::run_fork($child, { afterfork => $parent });
> -- 
> 2.47.3