linux-kernel - RE: [CFT][PATCH] proc: Update /proc/net to point at the accessing threads network namespace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <8be364fd938a4ac9959b4c01120cac97@AcuMS.aculab.com>
Date:   Tue, 4 Oct 2022 08:53:39 +0000
From:   David Laight <David.Laight@...LAB.COM>
To:     "'Eric W. Biederman'" <ebiederm@...ssion.com>
CC:     Linus Torvalds <torvalds@...ux-foundation.org>,
        Al Viro <viro@...iv.linux.org.uk>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        "Serge E. Hallyn" <serge@...lyn.com>
Subject: RE: [CFT][PATCH] proc: Update /proc/net to point at the accessing
 threads network namespace

From: Eric W. Biederman
> Sent: 03 October 2022 18:07
> 
> David Laight <David.Laight@...LAB.COM> writes:
> 
> > From: Eric W. Biederman
...
> > Part of the problem is that changing the net namespace isn't
> > enough, you also have to remount /sys - which isn't entirely
> > trivial.
> 
> Yes.  That is actually a much more maintainable model.  But it is still
> imperfect.    I was thinking about the proc/net directories when
> I made my comment.  Unlike proc where we have task ids there is nothing
> in /proc that can do anything.
> 
> > It might be possibly to mount a network namespace version
> > of /sys on a different mountpoint - I've not tried very
> > hard to do that.
> 
> It is a bug if that doesn't work.

The difficultly is picking the 'spell'.
I think you need to run mount after switching to the namespace.
But you don't want the unshare() that 'ip netns exec' does.
So I think it needs a silly wrapper program.

> >> > Notwithstanding the apparmor issues, /proc/net could actuall be
> >> > a symlink to (say) /proc/net_namespaces/namespace_name with
> >> > readlink returning the name based on the threads actual namespace.
> >>
> >> There really aren't good names for namespaces at the kernel level.  As
> >> one of their use cases is to make process migration possible between
> >> machines.  So any kernel level name would need to be migrated as well.
> >> So those kernel level names would need a name in another namespace,
> >> or an extra namespace would have to be created for those names.
> >
> > Network namespaces do seem to have names.
> > Although I gave up working out how to change to a named network
> > namespace from within the kernel (especially in a non-GPL module).
> 
> Network namespaces have mount points.  The mount points have names.
> 
> It is just a matter of finding the right filesystem and calling
> sys_rename().

I wanted to lookup a net namespace by name - so I could create
a kernel socket in a namespace specified in configuration data.
Not change the name of a namespace.

I ended up only giving a few options - basically saving the
namespace of code that called into the driver.
(Harder in a non-gpl driver since you can't directly hold/release
the namespace itself - fortunately you can create a socket!)

	David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)