Re: CLONE_NEWIPC documentation

[ebiederm@xmission.com (Eric W. Biederman)]

Michael Kerrisk <mtk-manpages@gmx.net> writes:

> Hello Kirill,
>
> In 2.6.19, your patch to add support for CLONE_NEWIPC was included.  Is
> there there some for-userland-programmers documentation of this flag
> somewhere?  Would you be able to send some documentation to me (ideally as
> a patch to the clone.2 man page, but otherwise some plain text will do).
>
> If this flag is also supported for unshare(), then could you please send me
> a patch/text for that too?

In case someone else doesn't do better here is a short summary.

CLONE_NEWIPC creates a new ipc namespace for the new child and all
of it's children.  So far CAP_SYS_ADMIN is required.

An IPC namespace creates a new context for looking up and listing
SYSV IPC shared memory, message queues, and semaphores.  Only allowing
finding of SYSV IPC objects in this namespace.

For most practical purposes two processes in different SYSV IPC
namespaces might as well be on different machines.  As they cannot
find each others SYSV IPC resources, and so cannot interact with
each other that way.

The implementation is essentially just a lookup of the objects
in a different table when doing name to object translation so
there should be no measurable overhead.

When the last process in a SYSV IPC namespace exits any remaining
objects in that SYSV IPC namespace are destroyed.

Eric