From ef95be6e1c102c4e50f2730751ecf2b29f3a9bdc Mon Sep 17 00:00:00 2001 From: Andrei Vagin Date: Mon, 31 Jul 2023 14:31:30 -0700 Subject: [PATCH] kernel: check that a task has a network namespace task.GetNetworkNamespace has to be used when we try to access a remote task. PiperOrigin-RevId: 552593738 --- pkg/sentry/fsimpl/proc/task_net.go | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/pkg/sentry/fsimpl/proc/task_net.go b/pkg/sentry/fsimpl/proc/task_net.go index 1caf76a1b..01c93a4e9 100644 --- a/pkg/sentry/fsimpl/proc/task_net.go +++ b/pkg/sentry/fsimpl/proc/task_net.go @@ -43,7 +43,12 @@ func (fs *filesystem) newTaskNetDir(ctx context.Context, task *kernel.Task) kern root := auth.NewRootCredentials(pidns.UserNamespace()) var contents map[string]kernfs.Inode - if stack := task.NetworkNamespace().Stack(); stack != nil { + var stack inet.Stack + if netns := task.GetNetworkNamespace(); netns != nil { + netns.DecRef(ctx) + stack = netns.Stack() + } + if stack != nil { const ( arp = "IP address HW type Flags HW address Mask Device\n" netlink = "sk Eth Pid Groups Rmem Wmem Dump Locks Drops Inode\n"