netdev - [iproute PATCHv2 2/2] ipnetns: Make netns mount points private

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue,  5 Jul 2016 16:51:20 +0200
From:	Phil Sutter <phil@....cc>
To:	Stephen Hemminger <shemming@...cade.com>
Cc:	"Eric W . Biederman" <ebiederm@...ssion.com>,
	netdev@...r.kernel.org
Subject: [iproute PATCHv2 2/2] ipnetns: Make netns mount points private

On systems with a shared /proc mount point, the netns mounts inherit
that propagation group and therefore cause unnecessary overhead upon
netns deletion.

In order to achieve this, the MS_REC flag when making NETNS_RUN_DIR
shared has to be removed as well or otherwise it will make existing
netns mount points shared again.

Suggested-by: Miklos Szeredi <mszeredi@...hat.com>
Signed-off-by: Phil Sutter <phil@....cc>
---
 ip/ipnetns.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/ip/ipnetns.c b/ip/ipnetns.c
index 1cefe73c68bfc..acaedd5894e6c 100644
--- a/ip/ipnetns.c
+++ b/ip/ipnetns.c
@@ -636,7 +636,7 @@ static int netns_add(int argc, char **argv)
 	 * file in all namespaces allowing the network namespace to be freed
 	 * sooner.
 	 */
-	while (mount("", NETNS_RUN_DIR, "none", MS_SHARED | MS_REC, NULL)) {
+	while (mount("", NETNS_RUN_DIR, "none", MS_SHARED, NULL)) {
 		/* Fail unless we need to make the mount point */
 		if (errno != EINVAL || made_netns_run_dir_mount) {
 			fprintf(stderr, "mount --make-shared %s failed: %s\n",
@@ -678,6 +678,11 @@ static int netns_add(int argc, char **argv)
 			netns_path, strerror(errno));
 		goto out_delete;
 	}
+	if (mount("", netns_path, "none", MS_PRIVATE, NULL)) {
+		fprintf(stderr, "mount --make-private %s failed: %s\n",
+			netns_path, strerror(errno));
+		return -1;
+	}
 	return 0;
 out_delete:
 	netns_delete(argc, argv);
-- 
2.8.2