Process ids again

Posted Jun 7, 2025 19:29 UTC (Sat) by Nahor (subscriber, #51583)
In reply to: Process ids again by NYKevin
Parent article: Slowing the flow of core-dump-related CVEs

> PID namespaces

That looks like a big big can of worms.

How do non-updated apps and updated ones mix? Say an updated shell trying to start an old app or vice-versa?
Or do you expect the user to use different launcher/shell and choose which to interact with depending on what type of apps they use? And have different binaries with different pid size for apps used in both (shell, launcher, UI, ssh, ...)?
How do apps communicates pids with each other if they are not in the same namespace? Say someone uses an updated "top" command and thus gets 64-bit pids, then try to use the shell's builtin "kill" command which is still expecting 32-bit pid?

What/who decides what namespace to use? The kernel? The shell/launcher? The user? How does it/he/she know what namespace to use?

Namespaces work well if a whole ecosystem can be independent from everything else wrt to that namespace. They also work because only values changes, not the types, the binaries are the same (i.e. a shell in one namespace can work as well in another, they will just print different values for pids, or see different files, ...)

Process ids again

Posted Jun 8, 2025 3:16 UTC (Sun) by NYKevin (subscriber, #129325) [Link] (1 responses)

The idea would be, broadly speaking, all namespaces are 64-bit capable, but by default they only generate PIDs in the 32-bit compatible range. You can use the new 64-bit API for everything and it always works, and you can use the old API if you're in a namespace that is limited to the 32-bit range. A 64-bit namespace may contain 32-bit children, but not vice-versa.

The answers to most of your more specific questions can be summarized as "the distro can do what it sees fit, and if it chooses to do nothing, then it continues to use 32-bit PIDs for everything indefinitely."

Process ids again

Posted Jun 8, 2025 3:20 UTC (Sun) by NYKevin (subscriber, #129325) [Link]

Addendum: Some of your questions are better answered by referring you to pid_namespaces(7), which see.