2

How to check the device number of a device in /proc/1/ns/{ns}?

I've read the code for a Go library (see below), which states that it's possible to determine, if a container is in the host namespace or not: the device number of an unnamespaced /proc/1/ns/{ns} is 4 and anything else is higher.

Now, in a fresh Debian container without user namespace or cgroup, I run the following command:

root@54d74f795843:/# ls -la /proc/1/ns
total 0
dr-x--x--x 2 root root 0 Feb 29 17:18 .
dr-xr-xr-x 9 root root 0 Feb 29 17:18 ..
lrwxrwxrwx 1 root root 0 Feb 29 17:18 cgroup -> 'cgroup:[4026531835]'
lrwxrwxrwx 1 root root 0 Feb 29 17:18 ipc -> 'ipc:[4026532290]'
lrwxrwxrwx 1 root root 0 Feb 29 17:18 mnt -> 'mnt:[4026532288]'
lrwxrwxrwx 1 root root 0 Feb 29 17:18 net -> 'net:[4026532293]'
lrwxrwxrwx 1 root root 0 Feb 29 17:18 pid -> 'pid:[4026532291]'
lrwxrwxrwx 1 root root 0 Feb 29 17:18 user -> 'user:[4026531837]'
lrwxrwxrwx 1 root root 0 Feb 29 17:18 uts -> 'uts:[4026532289]'

What does the 4026531837 in 'user:[4026531837]' mean here? I cannot be the device number, because the container is using the same user namespace as the host (I've verified that).

How can I list the device numbers of the files /proc/1/ns/{ns}? The ls -la command shows those files are symbolic links, so how can they have a device number?

amicontained/vendor/github.com/jessfraz/bpfd/proc/proc.go/

// HasNamespace determines if a container is using a particular namespace or the
// host namespace.
// The device number of an unnamespaced /proc/1/ns/{ns} is 4 and anything else is
// higher.
// Only works from inside a container.
func HasNamespace(ns string) (bool, error) {
    file := fmt.Sprintf("/proc/1/ns/%s", ns)

    // Use Lstat to not follow the symlink.
    var info syscall.Stat_t
    if err := syscall.Lstat(file, &info); err != nil {
        return false, &os.PathError{Op: "lstat", Path: file, Err: err}
    }

    // Get the device number. If it is higher than 4 it is in a namespace.
    if info.Dev > 4 {
        return true, nil
    }

    return false, nil
}
1
  • What makes you think that symbolic links don't have a device number? ALL the files have a device number -- check the stat(2) manpage (don't confuse st_dev with st_rdev). That's how you can tell if two paths refer to the same file: stat them and compare their dev:ino tuple. BTW the trick from the Q doesn't work. The device number of the ns files is still 4 inside the container.
    – user313992
    Mar 1, 2020 at 13:57

1 Answer 1

2

What does the 4026531837 in 'user:[4026531837]' mean here?

These numbers are the inode numbers of files implemented by the nsfs filesystem, which could be opened and used with the setns(2) to associate a process with a namespace.

How can I list the device numbers of the files /proc/1/ns/{ns}?

According to a systemd issue discussion (Virtualization detection via /proc/1/sched no longer works on Linux 4.14+ ):

On the systems I could test (Arch with kernel 4.15.1, Debian Jessie with kernel 4.9.65, and Ubuntu Artful with kernel 4.13.0), the device number of an unnamespaced /proc/1/ns/pid always seems to be 4, while in a PID namespace it’s a different, higher number, apparently related to the number of (PID?) namespaces. You can try it with these commands:

stat --format %d /proc/1/ns/pid
4
sudo unshare --pid --fork --mount-proc stat --format %d /proc/1/ns/pid
36
3
  • Thank you, but how can I get the device numbers?
    – Shuzheng
    Feb 29, 2020 at 18:05
  • Thank you, again! Very helpful. Why does every file have a device number? Is it the number of the device on which the file resides? If that's the case, how can files in /proc/1/ns have different device numbers? After all, they all reside on the same nsfs filesystem, don't they?
    – Shuzheng
    Mar 1, 2020 at 12:27
  • 1
    The device number of /proc/pid/ns/* will not be different because they're running in a namespace/container, but because the proc fs was mounted over in the container (as an effect that --mount-proc option). That's NOT a reliable way to do any "virtualization detection".
    – user313992
    Mar 2, 2020 at 15:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .