linux/tools/testing/selftests/namespaces/nsid_test.c

// SPDX-License-Identifier: GPL-2.0

#include <assert.h>
#include <fcntl.h>
#include <inttypes.h>
#include <libgen.h>
#include <limits.h>
#include <pthread.h>
#include <signal.h>
#include <string.h>
#include <sys/mount.h>
#include <poll.h>
#include <sys/epoll.h>
#include <sys/resource.h>
#include <sys/stat.h>
#include <sys/socket.h>
#include <sys/un.h>
#include <sys/wait.h>
#include <unistd.h>
#include <linux/fs.h>
#include <linux/limits.h>
#include <linux/nsfs.h>
#include "kselftest_harness.h"

/* Fixture for tests that create child processes */
FIXTURE(nsid) {
	pid_t child_pid;
};

FIXTURE_SETUP(nsid) {
	self->child_pid = 0;
}

FIXTURE_TEARDOWN(nsid) {
	/* Clean up any child process that may still be running */
	if (self->child_pid > 0) {
		kill(self->child_pid, SIGKILL);
		waitpid(self->child_pid, NULL, 0);
	}
}

TEST(nsid_mntns_basic)
{
	__u64 mnt_ns_id = 0;
	int fd_mntns;
	int ret;

	/* Open the current mount namespace */
	fd_mntns = open("/proc/self/ns/mnt", O_RDONLY);
	ASSERT_GE(fd_mntns, 0);

	/* Get the mount namespace ID */
	ret = ioctl(fd_mntns, NS_GET_MNTNS_ID, &mnt_ns_id);
	ASSERT_EQ(ret, 0);
	ASSERT_NE(mnt_ns_id, 0);

	/* Verify we can get the same ID again */
	__u64 mnt_ns_id2 = 0;
	ret = ioctl(fd_mntns, NS_GET_ID, &mnt_ns_id2);
	ASSERT_EQ(ret, 0);
	ASSERT_EQ(mnt_ns_id, mnt_ns_id2);

	close(fd_mntns);
}

TEST_F(nsid, mntns_separate)
{
	__u64 parent_mnt_ns_id = 0;
	__u64 child_mnt_ns_id = 0;
	int fd_parent_mntns, fd_child_mntns;
	int ret;
	pid_t pid;
	int pipefd[2];

	/* Get parent's mount namespace ID */
	fd_parent_mntns = open("/proc/self/ns/mnt", O_RDONLY);
	ASSERT_GE(fd_parent_mntns, 0);
	ret = ioctl(fd_parent_mntns, NS_GET_ID, &parent_mnt_ns_id);
	ASSERT_EQ(ret, 0);
	ASSERT_NE(parent_mnt_ns_id, 0);

	/* Create a pipe for synchronization */
	ASSERT_EQ(pipe(pipefd), 0);

	pid = fork();
	ASSERT_GE(pid, 0);

	if (pid == 0) {
		/* Child process */
		close(pipefd[0]);

		/* Create new mount namespace */
		ret = unshare(CLONE_NEWNS);
		if (ret != 0) {
			/* Skip test if we don't have permission */
			if (errno == EPERM || errno == EACCES) {
				write(pipefd[1], "S", 1); /* Signal skip */
				_exit(0);
			}
			_exit(1);
		}

		/* Signal success */
		write(pipefd[1], "Y", 1);
		close(pipefd[1]);

		/* Keep namespace alive */
		pause();
		_exit(0);
	}

	/* Track child for cleanup */
	self->child_pid = pid;

	/* Parent process */
	close(pipefd[1]);

	char buf;
	ASSERT_EQ(read(pipefd[0], &buf, 1), 1);
	close(pipefd[0]);

	if (buf == 'S') {
		/* Child couldn't create namespace, skip test */
		close(fd_parent_mntns);
		SKIP(return, "No permission to create mount namespace");
	}

	ASSERT_EQ(buf, 'Y');

	/* Open child's mount namespace */
	char path[256];
	snprintf(path, sizeof(path), "/proc/%d/ns/mnt", pid);
	fd_child_mntns = open(path, O_RDONLY);
	ASSERT_GE(fd_child_mntns, 0);

	/* Get child's mount namespace ID */
	ret = ioctl(fd_child_mntns, NS_GET_ID, &child_mnt_ns_id);
	ASSERT_EQ(ret, 0);
	ASSERT_NE(child_mnt_ns_id, 0);

	/* Parent and child should have different mount namespace IDs */
	ASSERT_NE(parent_mnt_ns_id, child_mnt_ns_id);

	close(fd_parent_mntns);
	close(fd_child_mntns);
}

TEST(nsid_cgroupns_basic)
{
	__u64 cgroup_ns_id = 0;
	int fd_cgroupns;
	int ret;

	/* Open the current cgroup namespace */
	fd_cgroupns = open("/proc/self/ns/cgroup", O_RDONLY);
	ASSERT_GE(fd_cgroupns, 0);

	/* Get the cgroup namespace ID */
	ret = ioctl(fd_cgroupns, NS_GET_ID, &cgroup_ns_id);
	ASSERT_EQ(ret, 0);
	ASSERT_NE(cgroup_ns_id, 0);

	/* Verify we can get the same ID again */
	__u64 cgroup_ns_id2 = 0;
	ret = ioctl(fd_cgroupns, NS_GET_ID, &cgroup_ns_id2);
	ASSERT_EQ(ret, 0);
	ASSERT_EQ(cgroup_ns_id, cgroup_ns_id2);

	close(fd_cgroupns);
}

TEST_F(nsid, cgroupns_separate)
{
	__u64 parent_cgroup_ns_id = 0;
	__u64 child_cgroup_ns_id = 0;
	int fd_parent_cgroupns, fd_child_cgroupns;
	int ret;
	pid_t pid;
	int pipefd[2];

	/* Get parent's cgroup namespace ID */
	fd_parent_cgroupns = open("/proc/self/ns/cgroup", O_RDONLY);
	ASSERT_GE(fd_parent_cgroupns, 0);
	ret = ioctl(fd_parent_cgroupns, NS_GET_ID, &parent_cgroup_ns_id);
	ASSERT_EQ(ret, 0);
	ASSERT_NE(parent_cgroup_ns_id, 0);

	/* Create a pipe for synchronization */
	ASSERT_EQ(pipe(pipefd), 0);

	pid = fork();
	ASSERT_GE(pid, 0);

	if (pid == 0) {
		/* Child process */
		close(pipefd[0]);

		/* Create new cgroup namespace */
		ret = unshare(CLONE_NEWCGROUP);
		if (ret != 0) {
			/* Skip test if we don't have permission */
			if (errno == EPERM || errno == EACCES) {
				write(pipefd[1], "S", 1); /* Signal skip */
				_exit(0);
			}
			_exit(1);
		}

		/* Signal success */
		write(pipefd[1], "Y", 1);
		close(pipefd[1]);

		/* Keep namespace alive */
		pause();
		_exit(0);
	}

	/* Track child for cleanup */
	self->child_pid = pid;

	/* Parent process */
	close(pipefd[1]);

	char buf;
	ASSERT_EQ(read(pipefd[0], &buf, 1), 1);
	close(pipefd[0]);

	if (buf == 'S') {
		/* Child couldn't create namespace, skip test */
		close(fd_parent_cgroupns);
		SKIP(return, "No permission to create cgroup namespace");
	}

	ASSERT_EQ(buf, 'Y');

	/* Open child's cgroup namespace */
	char path[256];
	snprintf(path, sizeof(path), "/proc/%d/ns/cgroup", pid);
	fd_child_cgroupns = open(path, O_RDONLY);
	ASSERT_GE(fd_child_cgroupns, 0);

	/* Get child's cgroup namespace ID */
	ret = ioctl(fd_child_cgroupns, NS_GET_ID, &child_cgroup_ns_id);
	ASSERT_EQ(ret, 0);
	ASSERT_NE(child_cgroup_ns_id, 0);

	/* Parent and child should have different cgroup namespace IDs */
	ASSERT_NE(parent_cgroup_ns_id, child_cgroup_ns_id);

	close(fd_parent_cgroupns);
	close(fd_child_cgroupns);
}

TEST(nsid_ipcns_basic)
{
	__u64 ipc_ns_id = 0;
	int fd_ipcns;
	int ret;

	/* Open the current IPC namespace */
	fd_ipcns = open("/proc/self/ns/ipc", O_RDONLY);
	ASSERT_GE(fd_ipcns, 0);

	/* Get the IPC namespace ID */
	ret = ioctl(fd_ipcns, NS_GET_ID, &ipc_ns_id);
	ASSERT_EQ(ret, 0);
	ASSERT_NE(ipc_ns_id, 0);

	/* Verify we can get the same ID again */
	__u64 ipc_ns_id2 = 0;
	ret = ioctl(fd_ipcns, NS_GET_ID, &ipc_ns_id2);
	ASSERT_EQ(ret, 0);
	ASSERT_EQ(ipc_ns_id, ipc_ns_id2);

	close(fd_ipcns);
}

TEST_F(nsid, ipcns_separate)
{
	__u64 parent_ipc_ns_id = 0;
	__u64 child_ipc_ns_id = 0;
	int fd_parent_ipcns, fd_child_ipcns;
	int ret;
	pid_t pid;
	int pipefd[2];

	/* Get parent's IPC namespace ID */
	fd_parent_ipcns = open("/proc/self/ns/ipc", O_RDONLY);
	ASSERT_GE(fd_parent_ipcns, 0);
	ret = ioctl(fd_parent_ipcns, NS_GET_ID, &parent_ipc_ns_id);
	ASSERT_EQ(ret, 0);
	ASSERT_NE(parent_ipc_ns_id, 0);

	/* Create a pipe for synchronization */
	ASSERT_EQ(pipe(pipefd), 0);

	pid = fork();
	ASSERT_GE(pid, 0);

	if (pid == 0) {
		/* Child process */
		close(pipefd[0]);

		/* Create new IPC namespace */
		ret = unshare(CLONE_NEWIPC);
		if (ret != 0) {
			/* Skip test if we don't have permission */
			if (errno == EPERM || errno == EACCES) {
				write(pipefd[1], "S", 1); /* Signal skip */
				_exit(0);
			}
			_exit(1);
		}

		/* Signal success */
		write(pipefd[1], "Y", 1);
		close(pipefd[1]);

		/* Keep namespace alive */
		pause();
		_exit(0);
	}

	/* Track child for cleanup */
	self->child_pid = pid;

	/* Parent process */
	close(pipefd[1]);

	char buf;
	ASSERT_EQ(read(pipefd[0], &buf, 1), 1);
	close(pipefd[0]);

	if (buf == 'S') {
		/* Child couldn't create namespace, skip test */
		close(fd_parent_ipcns);
		SKIP(return, "No permission to create IPC namespace");
	}

	ASSERT_EQ(buf, 'Y');

	/* Open child's IPC namespace */
	char path[256];
	snprintf(path, sizeof(path), "/proc/%d/ns/ipc", pid);
	fd_child_ipcns = open(path, O_RDONLY);
	ASSERT_GE(fd_child_ipcns, 0);

	/* Get child's IPC namespace ID */
	ret = ioctl(fd_child_ipcns, NS_GET_ID, &child_ipc_ns_id);
	ASSERT_EQ(ret, 0);
	ASSERT_NE(child_ipc_ns_id, 0);

	/* Parent and child should have different IPC namespace IDs */
	ASSERT_NE(parent_ipc_ns_id, child_ipc_ns_id);

	close(fd_parent_ipcns);
	close(fd_child_ipcns);
}

TEST(nsid_utsns_basic)
{
	__u64 uts_ns_id = 0;
	int fd_utsns;
	int ret;

	/* Open the current UTS namespace */
	fd_utsns = open("/proc/self/ns/uts", O_RDONLY);
	ASSERT_GE(fd_utsns, 0);

	/* Get the UTS namespace ID */
	ret = ioctl(fd_utsns, NS_GET_ID, &uts_ns_id);
	ASSERT_EQ(ret, 0);
	ASSERT_NE(uts_ns_id, 0);

	/* Verify we can get the same ID again */
	__u64 uts_ns_id2 = 0;
	ret = ioctl(fd_utsns, NS_GET_ID, &uts_ns_id2);
	ASSERT_EQ(ret, 0);
	ASSERT_EQ(uts_ns_id, uts_ns_id2);

	close(fd_utsns);
}

TEST_F(nsid, utsns_separate)
{
	__u64 parent_uts_ns_id = 0;
	__u64 child_uts_ns_id = 0;
	int fd_parent_utsns, fd_child_utsns;
	int ret;
	pid_t pid;
	int pipefd[2];

	/* Get parent's UTS namespace ID */
	fd_parent_utsns = open("/proc/self/ns/uts", O_RDONLY);
	ASSERT_GE(fd_parent_utsns, 0);
	ret = ioctl(fd_parent_utsns, NS_GET_ID, &parent_uts_ns_id);
	ASSERT_EQ(ret, 0);
	ASSERT_NE(parent_uts_ns_id, 0);

	/* Create a pipe for synchronization */
	ASSERT_EQ(pipe(pipefd), 0);

	pid = fork();
	ASSERT_GE(pid, 0);

	if (pid == 0) {
		/* Child process */
		close(pipefd[0]);

		/* Create new UTS namespace */
		ret = unshare(CLONE_NEWUTS);
		if (ret != 0) {
			/* Skip test if we don't have permission */
			if (errno == EPERM || errno == EACCES) {
				write(pipefd[1], "S", 1); /* Signal skip */
				_exit(0);
			}
			_exit(1);
		}

		/* Signal success */
		write(pipefd[1], "Y", 1);
		close(pipefd[1]);

		/* Keep namespace alive */
		pause();
		_exit(0);
	}

	/* Track child for cleanup */
	self->child_pid = pid;

	/* Parent process */
	close(pipefd[1]);

	char buf;
	ASSERT_EQ(read(pipefd[0], &buf, 1), 1);
	close(pipefd[0]);

	if (buf == 'S') {
		/* Child couldn't create namespace, skip test */
		close(fd_parent_utsns);
		SKIP(return, "No permission to create UTS namespace");
	}

	ASSERT_EQ(buf, 'Y');

	/* Open child's UTS namespace */
	char path[256];
	snprintf(path, sizeof(path), "/proc/%d/ns/uts", pid);
	fd_child_utsns = open(path, O_RDONLY);
	ASSERT_GE(fd_child_utsns, 0);

	/* Get child's UTS namespace ID */
	ret = ioctl(fd_child_utsns, NS_GET_ID, &child_uts_ns_id);
	ASSERT_EQ(ret, 0);
	ASSERT_NE(child_uts_ns_id, 0);

	/* Parent and child should have different UTS namespace IDs */
	ASSERT_NE(parent_uts_ns_id, child_uts_ns_id);

	close(fd_parent_utsns);
	close(fd_child_utsns);
}

TEST(nsid_userns_basic)
{
	__u64 user_ns_id = 0;
	int fd_userns;
	int ret;

	/* Open the current user namespace */
	fd_userns = open("/proc/self/ns/user", O_RDONLY);
	ASSERT_GE(fd_userns, 0);

	/* Get the user namespace ID */
	ret = ioctl(fd_userns, NS_GET_ID, &user_ns_id);
	ASSERT_EQ(ret, 0);
	ASSERT_NE(user_ns_id, 0);

	/* Verify we can get the same ID again */
	__u64 user_ns_id2 = 0;
	ret = ioctl(fd_userns, NS_GET_ID, &user_ns_id2);
	ASSERT_EQ(ret, 0);
	ASSERT_EQ(user_ns_id, user_ns_id2);

	close(fd_userns);
}

TEST_F(nsid, userns_separate)
{
	__u64 parent_user_ns_id = 0;
	__u64 child_user_ns_id = 0;
	int fd_parent_userns, fd_child_userns;
	int ret;
	pid_t pid;
	int pipefd[2];

	/* Get parent's user namespace ID */
	fd_parent_userns = open("/proc/self/ns/user", O_RDONLY);
	ASSERT_GE(fd_parent_userns, 0);
	ret = ioctl(fd_parent_userns, NS_GET_ID, &parent_user_ns_id);
	ASSERT_EQ(ret, 0);
	ASSERT_NE(parent_user_ns_id, 0);

	/* Create a pipe for synchronization */
	ASSERT_EQ(pipe(pipefd), 0);

	pid = fork();
	ASSERT_GE(pid, 0);

	if (pid == 0) {
		/* Child process */
		close(pipefd[0]);

		/* Create new user namespace */
		ret = unshare(CLONE_NEWUSER);
		if (ret != 0) {
			/* Skip test if we don't have permission */
			if (errno == EPERM || errno == EACCES) {
				write(pipefd[1], "S", 1); /* Signal skip */
				_exit(0);
			}
			_exit(1);
		}

		/* Signal success */
		write(pipefd[1], "Y", 1);
		close(pipefd[1]);

		/* Keep namespace alive */
		pause();
		_exit(0);
	}

	/* Track child for cleanup */
	self->child_pid = pid;

	/* Parent process */
	close(pipefd[1]);

	char buf;
	ASSERT_EQ(read(pipefd[0], &buf, 1), 1);
	close(pipefd[0]);

	if (buf == 'S') {
		/* Child couldn't create namespace, skip test */
		close(fd_parent_userns);
		SKIP(return, "No permission to create user namespace");
	}

	ASSERT_EQ(buf, 'Y');

	/* Open child's user namespace */
	char path[256];
	snprintf(path, sizeof(path), "/proc/%d/ns/user", pid);
	fd_child_userns = open(path, O_RDONLY);
	ASSERT_GE(fd_child_userns, 0);

	/* Get child's user namespace ID */
	ret = ioctl(fd_child_userns, NS_GET_ID, &child_user_ns_id);
	ASSERT_EQ(ret, 0);
	ASSERT_NE(child_user_ns_id, 0);

	/* Parent and child should have different user namespace IDs */
	ASSERT_NE(parent_user_ns_id, child_user_ns_id);

	close(fd_parent_userns);
	close(fd_child_userns);
}

TEST(nsid_timens_basic)
{
	__u64 time_ns_id = 0;
	int fd_timens;
	int ret;

	/* Open the current time namespace */
	fd_timens = open("/proc/self/ns/time", O_RDONLY);
	if (fd_timens < 0) {
		SKIP(return, "Time namespaces not supported");
	}

	/* Get the time namespace ID */
	ret = ioctl(fd_timens, NS_GET_ID, &time_ns_id);
	ASSERT_EQ(ret, 0);
	ASSERT_NE(time_ns_id, 0);

	/* Verify we can get the same ID again */
	__u64 time_ns_id2 = 0;
	ret = ioctl(fd_timens, NS_GET_ID, &time_ns_id2);
	ASSERT_EQ(ret, 0);
	ASSERT_EQ(time_ns_id, time_ns_id2);

	close(fd_timens);
}

TEST_F(nsid, timens_separate)
{
	__u64 parent_time_ns_id = 0;
	__u64 child_time_ns_id = 0;
	int fd_parent_timens, fd_child_timens;
	int ret;
	pid_t pid;
	int pipefd[2];

	/* Open the current time namespace */
	fd_parent_timens = open("/proc/self/ns/time", O_RDONLY);
	if (fd_parent_timens < 0) {
		SKIP(return, "Time namespaces not supported");
	}

	/* Get parent's time namespace ID */
	ret = ioctl(fd_parent_timens, NS_GET_ID, &parent_time_ns_id);
	ASSERT_EQ(ret, 0);
	ASSERT_NE(parent_time_ns_id, 0);

	/* Create a pipe for synchronization */
	ASSERT_EQ(pipe(pipefd), 0);

	pid = fork();
	ASSERT_GE(pid, 0);

	if (pid == 0) {
		/* Child process */
		close(pipefd[0]);

		/* Create new time namespace */
		ret = unshare(CLONE_NEWTIME);
		if (ret != 0) {
			/* Skip test if we don't have permission */
			if (errno == EPERM || errno == EACCES || errno == EINVAL) {
				write(pipefd[1], "S", 1); /* Signal skip */
				_exit(0);
			}
			_exit(1);
		}

		/* Fork a grandchild to actually enter the new namespace */
		pid_t grandchild = fork();
		if (grandchild == 0) {
			/* Grandchild is in the new namespace */
			write(pipefd[1], "Y", 1);
			close(pipefd[1]);
			pause();
			_exit(0);
		} else if (grandchild > 0) {
			/* Child writes grandchild PID and waits */
			write(pipefd[1], "Y", 1);
			write(pipefd[1], &grandchild, sizeof(grandchild));
			close(pipefd[1]);
			pause(); /* Keep the parent alive to maintain the grandchild */
			_exit(0);
		} else {
			_exit(1);
		}
	}

	/* Track child for cleanup */
	self->child_pid = pid;

	/* Parent process */
	close(pipefd[1]);

	char buf;
	ASSERT_EQ(read(pipefd[0], &buf, 1), 1);

	if (buf == 'S') {
		/* Child couldn't create namespace, skip test */
		close(fd_parent_timens);
		close(pipefd[0]);
		SKIP(return, "Cannot create time namespace");
	}

	ASSERT_EQ(buf, 'Y');

	pid_t grandchild_pid;
	ASSERT_EQ(read(pipefd[0], &grandchild_pid, sizeof(grandchild_pid)), sizeof(grandchild_pid));
	close(pipefd[0]);

	/* Open grandchild's time namespace */
	char path[256];
	snprintf(path, sizeof(path), "/proc/%d/ns/time", grandchild_pid);
	fd_child_timens = open(path, O_RDONLY);
	ASSERT_GE(fd_child_timens, 0);

	/* Get child's time namespace ID */
	ret = ioctl(fd_child_timens, NS_GET_ID, &child_time_ns_id);
	ASSERT_EQ(ret, 0);
	ASSERT_NE(child_time_ns_id, 0);

	/* Parent and child should have different time namespace IDs */
	ASSERT_NE(parent_time_ns_id, child_time_ns_id);

	close(fd_parent_timens);
	close(fd_child_timens);
}

TEST(nsid_pidns_basic)
{
	__u64 pid_ns_id = 0;
	int fd_pidns;
	int ret;

	/* Open the current PID namespace */
	fd_pidns = open("/proc/self/ns/pid", O_RDONLY);
	ASSERT_GE(fd_pidns, 0);

	/* Get the PID namespace ID */
	ret = ioctl(fd_pidns, NS_GET_ID, &pid_ns_id);
	ASSERT_EQ(ret, 0);
	ASSERT_NE(pid_ns_id, 0);

	/* Verify we can get the same ID again */
	__u64 pid_ns_id2 = 0;
	ret = ioctl(fd_pidns, NS_GET_ID, &pid_ns_id2);
	ASSERT_EQ(ret, 0);
	ASSERT_EQ(pid_ns_id, pid_ns_id2);

	close(fd_pidns);
}

TEST_F(nsid, pidns_separate)
{
	__u64 parent_pid_ns_id = 0;
	__u64 child_pid_ns_id = 0;
	int fd_parent_pidns, fd_child_pidns;
	int ret;
	pid_t pid;
	int pipefd[2];

	/* Get parent's PID namespace ID */
	fd_parent_pidns = open("/proc/self/ns/pid", O_RDONLY);
	ASSERT_GE(fd_parent_pidns, 0);
	ret = ioctl(fd_parent_pidns, NS_GET_ID, &parent_pid_ns_id);
	ASSERT_EQ(ret, 0);
	ASSERT_NE(parent_pid_ns_id, 0);

	/* Create a pipe for synchronization */
	ASSERT_EQ(pipe(pipefd), 0);

	pid = fork();
	ASSERT_GE(pid, 0);

	if (pid == 0) {
		/* Child process */
		close(pipefd[0]);

		/* Create new PID namespace */
		ret = unshare(CLONE_NEWPID);
		if (ret != 0) {
			/* Skip test if we don't have permission */
			if (errno == EPERM || errno == EACCES) {
				write(pipefd[1], "S", 1); /* Signal skip */
				_exit(0);
			}
			_exit(1);
		}

		/* Fork a grandchild to actually enter the new namespace */
		pid_t grandchild = fork();
		if (grandchild == 0) {
			/* Grandchild is in the new namespace */
			write(pipefd[1], "Y", 1);
			close(pipefd[1]);
			pause();
			_exit(0);
		} else if (grandchild > 0) {
			/* Child writes grandchild PID and waits */
			write(pipefd[1], "Y", 1);
			write(pipefd[1], &grandchild, sizeof(grandchild));
			close(pipefd[1]);
			pause(); /* Keep the parent alive to maintain the grandchild */
			_exit(0);
		} else {
			_exit(1);
		}
	}

	/* Track child for cleanup */
	self->child_pid = pid;

	/* Parent process */
	close(pipefd[1]);

	char buf;
	ASSERT_EQ(read(pipefd[0], &buf, 1), 1);

	if (buf == 'S') {
		/* Child couldn't create namespace, skip test */
		close(fd_parent_pidns);
		close(pipefd[0]);
		SKIP(return, "No permission to create PID namespace");
	}

	ASSERT_EQ(buf, 'Y');

	pid_t grandchild_pid;
	ASSERT_EQ(read(pipefd[0], &grandchild_pid, sizeof(grandchild_pid)), sizeof(grandchild_pid));
	close(pipefd[0]);

	/* Open grandchild's PID namespace */
	char path[256];
	snprintf(path, sizeof(path), "/proc/%d/ns/pid", grandchild_pid);
	fd_child_pidns = open(path, O_RDONLY);
	ASSERT_GE(fd_child_pidns, 0);

	/* Get child's PID namespace ID */
	ret = ioctl(fd_child_pidns, NS_GET_ID, &child_pid_ns_id);
	ASSERT_EQ(ret, 0);
	ASSERT_NE(child_pid_ns_id, 0);

	/* Parent and child should have different PID namespace IDs */
	ASSERT_NE(parent_pid_ns_id, child_pid_ns_id);

	close(fd_parent_pidns);
	close(fd_child_pidns);
}

TEST(nsid_netns_basic)
{
	__u64 net_ns_id = 0;
	__u64 netns_cookie = 0;
	int fd_netns;
	int sock;
	socklen_t optlen;
	int ret;

	/* Open the current network namespace */
	fd_netns = open("/proc/self/ns/net", O_RDONLY);
	ASSERT_GE(fd_netns, 0);

	/* Get the network namespace ID via ioctl */
	ret = ioctl(fd_netns, NS_GET_ID, &net_ns_id);
	ASSERT_EQ(ret, 0);
	ASSERT_NE(net_ns_id, 0);

	/* Create a socket to get the SO_NETNS_COOKIE */
	sock = socket(AF_UNIX, SOCK_STREAM, 0);
	ASSERT_GE(sock, 0);

	/* Get the network namespace cookie via socket option */
	optlen = sizeof(netns_cookie);
	ret = getsockopt(sock, SOL_SOCKET, SO_NETNS_COOKIE, &netns_cookie, &optlen);
	ASSERT_EQ(ret, 0);
	ASSERT_EQ(optlen, sizeof(netns_cookie));

	/* The namespace ID and cookie should be identical */
	ASSERT_EQ(net_ns_id, netns_cookie);

	/* Verify we can get the same ID again */
	__u64 net_ns_id2 = 0;
	ret = ioctl(fd_netns, NS_GET_ID, &net_ns_id2);
	ASSERT_EQ(ret, 0);
	ASSERT_EQ(net_ns_id, net_ns_id2);

	close(sock);
	close(fd_netns);
}

TEST_F(nsid, netns_separate)
{
	__u64 parent_net_ns_id = 0;
	__u64 parent_netns_cookie = 0;
	__u64 child_net_ns_id = 0;
	__u64 child_netns_cookie = 0;
	int fd_parent_netns, fd_child_netns;
	int parent_sock, child_sock;
	socklen_t optlen;
	int ret;
	pid_t pid;
	int pipefd[2];

	/* Get parent's network namespace ID */
	fd_parent_netns = open("/proc/self/ns/net", O_RDONLY);
	ASSERT_GE(fd_parent_netns, 0);
	ret = ioctl(fd_parent_netns, NS_GET_ID, &parent_net_ns_id);
	ASSERT_EQ(ret, 0);
	ASSERT_NE(parent_net_ns_id, 0);

	/* Get parent's network namespace cookie */
	parent_sock = socket(AF_UNIX, SOCK_STREAM, 0);
	ASSERT_GE(parent_sock, 0);
	optlen = sizeof(parent_netns_cookie);
	ret = getsockopt(parent_sock, SOL_SOCKET, SO_NETNS_COOKIE, &parent_netns_cookie, &optlen);
	ASSERT_EQ(ret, 0);

	/* Verify parent's ID and cookie match */
	ASSERT_EQ(parent_net_ns_id, parent_netns_cookie);

	/* Create a pipe for synchronization */
	ASSERT_EQ(pipe(pipefd), 0);

	pid = fork();
	ASSERT_GE(pid, 0);

	if (pid == 0) {
		/* Child process */
		close(pipefd[0]);

		/* Create new network namespace */
		ret = unshare(CLONE_NEWNET);
		if (ret != 0) {
			/* Skip test if we don't have permission */
			if (errno == EPERM || errno == EACCES) {
				write(pipefd[1], "S", 1); /* Signal skip */
				_exit(0);
			}
			_exit(1);
		}

		/* Signal success */
		write(pipefd[1], "Y", 1);
		close(pipefd[1]);

		/* Keep namespace alive */
		pause();
		_exit(0);
	}

	/* Track child for cleanup */
	self->child_pid = pid;

	/* Parent process */
	close(pipefd[1]);

	char buf;
	ASSERT_EQ(read(pipefd[0], &buf, 1), 1);
	close(pipefd[0]);

	if (buf == 'S') {
		/* Child couldn't create namespace, skip test */
		close(fd_parent_netns);
		close(parent_sock);
		SKIP(return, "No permission to create network namespace");
	}

	ASSERT_EQ(buf, 'Y');

	/* Open child's network namespace */
	char path[256];
	snprintf(path, sizeof(path), "/proc/%d/ns/net", pid);
	fd_child_netns = open(path, O_RDONLY);
	ASSERT_GE(fd_child_netns, 0);

	/* Get child's network namespace ID */
	ret = ioctl(fd_child_netns, NS_GET_ID, &child_net_ns_id);
	ASSERT_EQ(ret, 0);
	ASSERT_NE(child_net_ns_id, 0);

	/* Create socket in child's namespace to get cookie */
	ret = setns(fd_child_netns, CLONE_NEWNET);
	if (ret == 0) {
		child_sock = socket(AF_UNIX, SOCK_STREAM, 0);
		ASSERT_GE(child_sock, 0);

		optlen = sizeof(child_netns_cookie);
		ret = getsockopt(child_sock, SOL_SOCKET, SO_NETNS_COOKIE, &child_netns_cookie, &optlen);
		ASSERT_EQ(ret, 0);

		/* Verify child's ID and cookie match */
		ASSERT_EQ(child_net_ns_id, child_netns_cookie);

		close(child_sock);

		/* Return to parent namespace */
		setns(fd_parent_netns, CLONE_NEWNET);
	}

	/* Parent and child should have different network namespace IDs */
	ASSERT_NE(parent_net_ns_id, child_net_ns_id);
	if (child_netns_cookie != 0) {
		ASSERT_NE(parent_netns_cookie, child_netns_cookie);
	}

	close(fd_parent_netns);
	close(fd_child_netns);
	close(parent_sock);
}

TEST_HARNESS_MAIN