On Sun, Sep 06, 2026 at 03:17:58PM +0200, Christian Korneck wrote:

This is to allow running pasta inside a container without unmasking /proc for the whole container (Docker's --security-opt systempaths=unconfined, Podman's --security-opt unmask=ALL), which is undesirable as it exposes /proc/sysrq-trigger and other masked paths.

In spawn mode, pasta clones the command with CLONE_NEWPID and mounts a new procfs instance on /proc, so that it matches the new PID namespace.

Mounting procfs in a new user namespace requires a fully visible, unobstructed procfs. Container runtimes deliberately obstruct /proc (Docker, for example, masks /proc/kcore and friends and mounts /proc/sys read-only), so the mount is refused:

Couldn't mount /proc: Operation not permitted

We only warn and continue, leaving the command in a new PID namespace while the visible /proc still numbers processes in the outer one. Anything resolving its own PID through /proc then fails, for example bubblewrap:

bwrap: open /proc/22/ns/ns failed: No such file or directory

Add a --no-pidns option: skip CLONE_NEWPID for the spawned command and don't mount /proc, which is then not needed. User, network, mount, UTS and IPC namespaces, --config-net and port forwarding are unaffected. The option is rejected together with PID or --netns, as it only makes sense when we spawn the command ourselves.

Add a test checking that, by default, the command runs in a new PID namespace, and that --no-pidns keeps it in the caller's one.

I can see that this would be useful. On the other hand, I could say that for just about any combinatiom of unshare(1) options, and I don't think we want to reimplement all of unshare(1) in pasta. Note that it is always possible to create a namespace using unshare(1) with arbitrary options and then connect it with pasta, rather than having pasta create its own. That said, I've never seen the point of creating a pidns by default in pasta. We're not isolating the filesystem, so I don't see that there's much to gain by isolating pids. I'd be happy enough to see CLONE_NEWPID removed unconditionally.

Signed-off-by: Christian Korneck --- conf.c | 11 +++++++++++ passt.1 | 12 ++++++++++++ passt.h | 2 ++ pasta.c | 18 +++++++++++------- test/pasta_options/no_pidns | 25 +++++++++++++++++++++++++ test/run | 1 + 6 files changed, 62 insertions(+), 7 deletions(-) create mode 100644 test/pasta_options/no_pidns

diff --git a/conf.c b/conf.c index faf2681..16b2f40 100644 --- a/conf.c +++ b/conf.c @@ -742,6 +742,7 @@ pasta_opts: " implied if PATH or NAME are given without --userns\n" " --no-netns-quit Don't quit if filesystem-bound target\n" " network namespace is deleted\n" + " --no-pidns Don't spawn command in a new PID namespace\n" " --config-net Configure tap interface in namespace\n" " --no-copy-routes DEPRECATED:\n" " Don't copy all routes to namespace\n" @@ -1348,6 +1349,7 @@ void conf(struct ctx *c, int argc, char **argv) {"stats", required_argument, NULL, 31 }, {"conf-path", required_argument, NULL, 'c' }, {"chroot-fallback", no_argument, NULL, 32 }, + {"no-pidns", no_argument, NULL, 33 }, { 0 }, }; const char *optstring = "+dqfel:hs:c:F:I:p:P:m:a:n:M:g:i:o:D:S:H:461t:u:T:U:"; @@ -1589,6 +1591,12 @@ void conf(struct ctx *c, int argc, char **argv) case 32: c->chroot_fallback = true; break; + case 33: + if (c->mode != MODE_PASTA) + die("--no-pidns is for pasta mode only"); + + c->no_pidns = true; + break; case 'd': c->debug = 1; c->quiet = 0; @@ -1948,6 +1956,9 @@ void conf(struct ctx *c, int argc, char **argv) else if (optind != argc) die("Extra non-option argument: %s", argv[optind]);

+ if (c->no_pidns && *netns) + die("--no-pidns is incompatible with PID or --netns"); + conf_open_files(c); /* Before any possible setuid() / setgid() */

isolate_user(c, uid, gid, !netns_only, userns); diff --git a/passt.1 b/passt.1 index 53e072a..0b780fe 100644 --- a/passt.1 +++ b/passt.1 @@ -704,6 +704,18 @@ is bound to the filesystem, and the given path is deleted, or if the target network namespace is represented by a procfs entry, and that entry is deleted, representing the fact that a process with the given PID terminated.

+.TP +.BR \-\-no-pidns +Don't create a new PID namespace for the spawned command or shell: keep it in +the PID namespace \fBpasta\fR itself runs in, and don't mount a new +\fIprocfs\fR instance on \fI/proc\fR for it. This is useful in environments +where mounting \fIprocfs\fR is not permitted, such as containers, where the +command would otherwise get a \fI/proc\fR view that doesn't match its own PID +namespace. Note that, without a PID namespace, processes started by the +command are not terminated once the command exits. + +This option can't be specified with a PID or with \-\-netns. + .TP .BR \-\-config-net Configure networking in the namespace: set up addresses and routes as configured diff --git a/passt.h b/passt.h index 51ccd4f..afd8e9f 100644 --- a/passt.h +++ b/passt.h @@ -195,6 +195,7 @@ struct ip6_ctx { * @pasta_ifn: Name of namespace interface for pasta * @pasta_ifi: Index of namespace interface for pasta * @pasta_conf_ns: Configure namespace after creating it + * @no_pidns: Don't create a new PID namespace for spawned command * @fwd: Forwarding tables * @fwd_pending: Pending forward tables * @no_tcp: Disable TCP operation @@ -278,6 +279,7 @@ struct ctx { char pasta_ifn[IF_NAMESIZE]; unsigned int pasta_ifi; int pasta_conf_ns; + bool no_pidns;

struct fwd_table *fwd[PIF_NUM_TYPES]; struct fwd_table *fwd_pending[PIF_NUM_TYPES]; diff --git a/pasta.c b/pasta.c index 5aa56b7..2d916e1 100644 --- a/pasta.c +++ b/pasta.c @@ -194,15 +194,17 @@ static int pasta_spawn_cmd(void *arg) if (prctl(PR_SET_PDEATHSIG, SIGKILL)) die_perror("Couldn't set PR_SET_PDEATHSIG");

- /* We run in a detached PID and mount namespace: mount /proc over */ - if (mount("", "/proc", "proc", 0, NULL)) + a = (const struct pasta_spawn_cmd_arg *)arg; + + /* We run in a detached mount namespace, and, unless --no-pidns was + * given, in a detached PID namespace: mount /proc over + */ + if (!a->c->no_pidns && mount("", "/proc", "proc", 0, NULL)) warn_perror("Couldn't mount /proc");

if (write_file("/proc/sys/net/ipv4/ping_group_range", "0 0")) warn("Cannot set ping_group_range, ICMP requests might fail");

- a = (const struct pasta_spawn_cmd_arg *)arg; - conf_hostname_len = strlen(a->c->hostname); if (conf_hostname_len > 0) { if (sethostname(a->c->hostname, conf_hostname_len)) @@ -243,6 +245,7 @@ static int pasta_spawn_cmd(void *arg) void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid, bool config_idmaps, int argc, char *argv[]) { + int flags = CLONE_NEWIPC | CLONE_NEWNET | CLONE_NEWUTS | CLONE_NEWNS; char ns_fn_stack[NS_FN_STACK_SIZE] __attribute__ ((aligned(__alignof__(max_align_t)))); struct pasta_spawn_cmd_arg arg = { @@ -293,10 +296,11 @@ void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid, bool config_idmaps, sigaddset(&set, SIGUSR1); sigprocmask(SIG_BLOCK, &set, NULL);

+ if (!c->no_pidns) + flags |= CLONE_NEWPID; + pasta_child_pid = do_clone(pasta_spawn_cmd, ns_fn_stack, - sizeof(ns_fn_stack), - CLONE_NEWIPC | CLONE_NEWPID | CLONE_NEWNET | - CLONE_NEWUTS | CLONE_NEWNS | SIGCHLD, + sizeof(ns_fn_stack), flags | SIGCHLD, (void *)&arg);

if (pasta_child_pid == -1) diff --git a/test/pasta_options/no_pidns b/test/pasta_options/no_pidns new file mode 100644 index 0000000..f565b2f --- /dev/null +++ b/test/pasta_options/no_pidns @@ -0,0 +1,25 @@ +# SPDX-License-Identifier: GPL-2.0-or-later +# +# PASST - Plug A Simple Socket Transport +# for qemu/UNIX domain socket mode +# +# PASTA - Pack A Subtle Tap Abstraction +# for network namespace/tap device mode +# +# test/pasta_options/no_pidns - Check --no-pidns handling + +htools readlink + +test Command is spawned in a new PID namespace by default +set PIDNS __STATEDIR__/pidns +set OUT __STATEDIR__/no-pidns.out +set ERR __STATEDIR__/no-pidns.err + +passt readlink /proc/self/ns/pid > __PIDNS__ +passt ./pasta -q -- readlink /proc/self/ns/pid > __OUT__ 2> __ERR__ +check [ "$(cat __PIDNS__)" != "$(cat __OUT__)" ] + +test --no-pidns keeps command in the caller's PID namespace +passt ./pasta -q --no-pidns -- readlink /proc/self/ns/pid > __OUT__ 2> __ERR__ +check [ "$(cat __PIDNS__)" = "$(cat __OUT__)" ] +check [ ! -s __ERR__ ] diff --git a/test/run b/test/run index c4073cc..14ddbbf 100755 --- a/test/run +++ b/test/run @@ -86,6 +86,7 @@ run() { setup pasta_options test pasta_options/log_to_file test pasta_options/netns_only + test pasta_options/no_pidns teardown pasta_options

setup build -- 2.55.0

-- David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson

Christian, thanks for the patch. At a glance, it looks pretty good to me (see also my reply to David). There's just one thing I wanted to mention for your awareness before continuing with it, though: in the past couple of months, we had several reports of bubblewrap being started by pasta (directly or indirectly), see in particular: https://archives.passt.top/passt-user/671252c8-88f6-45b7-b719-b82786e84bb7@g... https://bugs.passt.top/show_bug.cgi?id=204 https://archives.passt.top/passt-dev/20260731132601.422518-1-rlawrence@tamu.... (still pending) so, while these kind of changes obviously appear useful for somebody, there's still the question of whether you want to consider spawning bubblewrap separately and make it join a network namespace connected by pasta (might need changes in bubblewrap, or something like https://github.com/reubenfirmin/bubblewrap-tui#why-pasta). -- Stefano On Sun, 6 Sep 2026 15:17:58 +0200 Christian Korneck wrote:

This is to allow running pasta inside a container without unmasking /proc for the whole container (Docker's --security-opt systempaths=unconfined, Podman's --security-opt unmask=ALL), which is undesirable as it exposes /proc/sysrq-trigger and other masked paths.

In spawn mode, pasta clones the command with CLONE_NEWPID and mounts a new procfs instance on /proc, so that it matches the new PID namespace.

Mounting procfs in a new user namespace requires a fully visible, unobstructed procfs. Container runtimes deliberately obstruct /proc (Docker, for example, masks /proc/kcore and friends and mounts /proc/sys read-only), so the mount is refused:

Couldn't mount /proc: Operation not permitted

We only warn and continue, leaving the command in a new PID namespace while the visible /proc still numbers processes in the outer one. Anything resolving its own PID through /proc then fails, for example bubblewrap:

bwrap: open /proc/22/ns/ns failed: No such file or directory

Add a --no-pidns option: skip CLONE_NEWPID for the spawned command and don't mount /proc, which is then not needed. User, network, mount, UTS and IPC namespaces, --config-net and port forwarding are unaffected. The option is rejected together with PID or --netns, as it only makes sense when we spawn the command ourselves.

Add a test checking that, by default, the command runs in a new PID namespace, and that --no-pidns keeps it in the caller's one.

Signed-off-by: Christian Korneck --- conf.c | 11 +++++++++++ passt.1 | 12 ++++++++++++ passt.h | 2 ++ pasta.c | 18 +++++++++++------- test/pasta_options/no_pidns | 25 +++++++++++++++++++++++++ test/run | 1 + 6 files changed, 62 insertions(+), 7 deletions(-) create mode 100644 test/pasta_options/no_pidns

diff --git a/conf.c b/conf.c index faf2681..16b2f40 100644 --- a/conf.c +++ b/conf.c @@ -742,6 +742,7 @@ pasta_opts: " implied if PATH or NAME are given without --userns\n" " --no-netns-quit Don't quit if filesystem-bound target\n" " network namespace is deleted\n" + " --no-pidns Don't spawn command in a new PID namespace\n" " --config-net Configure tap interface in namespace\n" " --no-copy-routes DEPRECATED:\n" " Don't copy all routes to namespace\n" @@ -1348,6 +1349,7 @@ void conf(struct ctx *c, int argc, char **argv) {"stats", required_argument, NULL, 31 }, {"conf-path", required_argument, NULL, 'c' }, {"chroot-fallback", no_argument, NULL, 32 }, + {"no-pidns", no_argument, NULL, 33 }, { 0 }, }; const char *optstring = "+dqfel:hs:c:F:I:p:P:m:a:n:M:g:i:o:D:S:H:461t:u:T:U:"; @@ -1589,6 +1591,12 @@ void conf(struct ctx *c, int argc, char **argv) case 32: c->chroot_fallback = true; break; + case 33: + if (c->mode != MODE_PASTA) + die("--no-pidns is for pasta mode only"); + + c->no_pidns = true; + break; case 'd': c->debug = 1; c->quiet = 0; @@ -1948,6 +1956,9 @@ void conf(struct ctx *c, int argc, char **argv) else if (optind != argc) die("Extra non-option argument: %s", argv[optind]);

+ if (c->no_pidns && *netns) + die("--no-pidns is incompatible with PID or --netns"); + conf_open_files(c); /* Before any possible setuid() / setgid() */

isolate_user(c, uid, gid, !netns_only, userns); diff --git a/passt.1 b/passt.1 index 53e072a..0b780fe 100644 --- a/passt.1 +++ b/passt.1 @@ -704,6 +704,18 @@ is bound to the filesystem, and the given path is deleted, or if the target network namespace is represented by a procfs entry, and that entry is deleted, representing the fact that a process with the given PID terminated.

+.TP +.BR \-\-no-pidns +Don't create a new PID namespace for the spawned command or shell: keep it in +the PID namespace \fBpasta\fR itself runs in, and don't mount a new +\fIprocfs\fR instance on \fI/proc\fR for it. This is useful in environments +where mounting \fIprocfs\fR is not permitted, such as containers, where the +command would otherwise get a \fI/proc\fR view that doesn't match its own PID +namespace. Note that, without a PID namespace, processes started by the +command are not terminated once the command exits. + +This option can't be specified with a PID or with \-\-netns. + .TP .BR \-\-config-net Configure networking in the namespace: set up addresses and routes as configured diff --git a/passt.h b/passt.h index 51ccd4f..afd8e9f 100644 --- a/passt.h +++ b/passt.h @@ -195,6 +195,7 @@ struct ip6_ctx { * @pasta_ifn: Name of namespace interface for pasta * @pasta_ifi: Index of namespace interface for pasta * @pasta_conf_ns: Configure namespace after creating it + * @no_pidns: Don't create a new PID namespace for spawned command * @fwd: Forwarding tables * @fwd_pending: Pending forward tables * @no_tcp: Disable TCP operation @@ -278,6 +279,7 @@ struct ctx { char pasta_ifn[IF_NAMESIZE]; unsigned int pasta_ifi; int pasta_conf_ns; + bool no_pidns;

struct fwd_table *fwd[PIF_NUM_TYPES]; struct fwd_table *fwd_pending[PIF_NUM_TYPES]; diff --git a/pasta.c b/pasta.c index 5aa56b7..2d916e1 100644 --- a/pasta.c +++ b/pasta.c @@ -194,15 +194,17 @@ static int pasta_spawn_cmd(void *arg) if (prctl(PR_SET_PDEATHSIG, SIGKILL)) die_perror("Couldn't set PR_SET_PDEATHSIG");

- /* We run in a detached PID and mount namespace: mount /proc over */ - if (mount("", "/proc", "proc", 0, NULL)) + a = (const struct pasta_spawn_cmd_arg *)arg; + + /* We run in a detached mount namespace, and, unless --no-pidns was + * given, in a detached PID namespace: mount /proc over + */ + if (!a->c->no_pidns && mount("", "/proc", "proc", 0, NULL)) warn_perror("Couldn't mount /proc");

if (write_file("/proc/sys/net/ipv4/ping_group_range", "0 0")) warn("Cannot set ping_group_range, ICMP requests might fail");

- a = (const struct pasta_spawn_cmd_arg *)arg; - conf_hostname_len = strlen(a->c->hostname); if (conf_hostname_len > 0) { if (sethostname(a->c->hostname, conf_hostname_len)) @@ -243,6 +245,7 @@ static int pasta_spawn_cmd(void *arg) void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid, bool config_idmaps, int argc, char *argv[]) { + int flags = CLONE_NEWIPC | CLONE_NEWNET | CLONE_NEWUTS | CLONE_NEWNS; char ns_fn_stack[NS_FN_STACK_SIZE] __attribute__ ((aligned(__alignof__(max_align_t)))); struct pasta_spawn_cmd_arg arg = { @@ -293,10 +296,11 @@ void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid, bool config_idmaps, sigaddset(&set, SIGUSR1); sigprocmask(SIG_BLOCK, &set, NULL);

+ if (!c->no_pidns) + flags |= CLONE_NEWPID; + pasta_child_pid = do_clone(pasta_spawn_cmd, ns_fn_stack, - sizeof(ns_fn_stack), - CLONE_NEWIPC | CLONE_NEWPID | CLONE_NEWNET | - CLONE_NEWUTS | CLONE_NEWNS | SIGCHLD, + sizeof(ns_fn_stack), flags | SIGCHLD, (void *)&arg);

if (pasta_child_pid == -1) diff --git a/test/pasta_options/no_pidns b/test/pasta_options/no_pidns new file mode 100644 index 0000000..f565b2f --- /dev/null +++ b/test/pasta_options/no_pidns @@ -0,0 +1,25 @@ +# SPDX-License-Identifier: GPL-2.0-or-later +# +# PASST - Plug A Simple Socket Transport +# for qemu/UNIX domain socket mode +# +# PASTA - Pack A Subtle Tap Abstraction +# for network namespace/tap device mode +# +# test/pasta_options/no_pidns - Check --no-pidns handling + +htools readlink + +test Command is spawned in a new PID namespace by default +set PIDNS __STATEDIR__/pidns +set OUT __STATEDIR__/no-pidns.out +set ERR __STATEDIR__/no-pidns.err + +passt readlink /proc/self/ns/pid > __PIDNS__ +passt ./pasta -q -- readlink /proc/self/ns/pid > __OUT__ 2> __ERR__ +check [ "$(cat __PIDNS__)" != "$(cat __OUT__)" ] + +test --no-pidns keeps command in the caller's PID namespace +passt ./pasta -q --no-pidns -- readlink /proc/self/ns/pid > __OUT__ 2> __ERR__ +check [ "$(cat __PIDNS__)" = "$(cat __OUT__)" ] +check [ ! -s __ERR__ ] diff --git a/test/run b/test/run index c4073cc..14ddbbf 100755 --- a/test/run +++ b/test/run @@ -86,6 +86,7 @@ run() { setup pasta_options test pasta_options/log_to_file test pasta_options/netns_only + test pasta_options/no_pidns teardown pasta_options

setup build