netdev - Re: Problem removing netns

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Wed, 22 Aug 2012 16:59:58 -0700
From:	ebiederm@...ssion.com (Eric W. Biederman)
To:	Bjørnar Ness <bjornar.ness@...il.com>
Cc:	netdev@...r.kernel.org
Subject: Re: Problem removing netns

Bjørnar Ness <bjornar.ness@...il.com> writes:

> I am experimenting with netns (Linux precision 3.2.0-0.bpo.2-amd64 #1
> SMP Sun Jun 3 21:40:57 UTC 2012 x86_64 GNU/Linux)
> and have problems removing unused namespace, this is what I do:
>
> ip netns add netns_one
> ip netns add netns_two
> ip link add name if_one type veth peer name if_one_peer
> ip link add name if_two type veth peer name if_two_peer
> ip link set dev if_one_peer netns netns_one
> ip link set dev if_two_peer netns netns_two
>
> ip netns exec netns_one bash
>
> # in other terminal:
>
> ip netns delete netns_two
>
> # => Cannot remove /var/run/netns/netns_two: Device or resource busy
>
> Is this expected  behaviour? If so, what is the correct process to
> actually remove a namespace?

This is unintended but "correct" behavior.

The linux VFS won't let you remove an a file or directory that has
something mounted on it. 

Cloning the mount namespace creates a copy of all of the mounts.

With the result that your long running processe created with
ip netns exec (or anything else that clones the mount namespace)
will continue to hold a references to mounted that keesp the network
namespace alive.

In my usage patterns I haven't tripped over this.

Probably the simplest fix would be to take advantage of mount propogate
so that when we unmount the network namespace in one mount namespace it
get unmounted in all of them.  I don't expect I will be able to look at
implementing anything like that for a while, although it shouldn't take
much work to implement that.

Eric

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html