netdev - Re: loosing netdevices with namespaces and unshare?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 31 May 2017 10:44:53 -0700
From:   Cong Wang <xiyou.wangcong@...il.com>
To:     Harald Welte <laforge@...monks.org>
Cc:     Linux Kernel Network Developers <netdev@...r.kernel.org>
Subject: Re: loosing netdevices with namespaces and unshare?

On Wed, May 31, 2017 at 5:27 AM, Harald Welte <laforge@...monks.org> wrote:
> Hi Cong,
>
> On Tue, May 30, 2017 at 04:18:17PM -0700, Cong Wang wrote:
>> On Tue, May 30, 2017 at 3:07 PM, Harald Welte <laforge@...monks.org> wrote:
>> > But, to the contrary, this doesn't happen.  The unshare-created netns is
>> > gone, but the netdevice did not get moved back to the root namespace
>> > either.  The only hack to get back to the "eth0" device is to unload the
>> > driver and re-load it.
>>
>>
>> Net namespace simply unregisters all netdevices inside when it is
>> gone, no matter where they are from.
>
> ah, ok. I missed that part.  Is there a good piece of documentation on
> netwokr namespaces that I should read?

I don't know any doc mentioning this.


>> I am pretty sure you can move it back to root-ns if you want,
>
> Yes, I can explicitly do that, but this of course doesn't work if e.g.
> my [single] process in that namespace crashes due to some bug, OOM or
> the like.
>
>> it is a little tricky because you have to give the root-ns a name
>> first.
>
> It's actually not, as you can just identify the root-ns by pid 1, so
> "ip link set $DEV netns 1" will move it back.  As indicated, I'm worried
> about the error paths.
>

Yeah, using PID works too. Unfortunately the whole namespace
is gone too no matter the last process exits normally or not, it is
just refcount'ed.


>> > What am I missing here?  Is this the intended behavior?
>>
>> Yes it is.
>
> thanks for your confirmation.  Guess I have to get used to it.
>
>> > Of course I know I could simply do something like "ip link set eth0
>> > netns 1" from within the namespace before leaving.  But what if the
>> > process is not bash and the process exits abnormally?   I'd consider
>> > that explicit reassignment more like a hack than a proper solution...
>>
>> It doesn't make sense to move it back to where it is from, for example,
>> what if you move a veth0 from netns1 to netns2 and netns1 is gone
>> before netns2?
>
> for virtual devices, I would agree.  For physical devices, I think the
> default behavior to unregister them is - from my of course very
> subjective point of view - quite questionable.

Network namespace does not special-case the physical devices,
it treats them all equally as abstract net devices.

Hope this helps.