netdev - Re: [iproute PATCH 0/2] Netns performance improvements

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 05 Jul 2016 09:44:00 -0500
From:	ebiederm@...ssion.com (Eric W. Biederman)
To:	Phil Sutter <phil@....cc>
Cc:	Stephen Hemminger <shemming@...cade.com>, netdev@...r.kernel.org
Subject: Re: [iproute PATCH 0/2] Netns performance improvements

Phil Sutter <phil@....cc> writes:

> Stress-testing OpenStack Neutron revealed poor performance of 'ip netns'
> when dealing with a high amount of namespaces. The cause of this lies in
> the combination of how iproute2 mounts NETNS_RUN_DIR and the netns files
> therein and the fact that systemd makes all mount points of the system
> shared.

So please tell me.  Given that it was clearly a deliberate choice in the
code to make these directories shared, and that this is not a result
of a systemd making all directories shared by default.  Why is it
better to these directories non-shared?

This may be the appropriate change but saying you stress testing things
and have a problem but do not describe how large a scale you had a
problem, or anything else to make your problem reproducible by anyone
else makes it difficult to consider the merits of this change.

Sometimes things are a good default policy but have imperfect scaling on
extreme workloads.

My experience with the current situtation with ip netns is that it
prevents a whole lot of confusion by making the network namespace names
visible whichever mount namespace your processes are running in.

> Phil Sutter (2):
>   ipnetns: Move NETNS_RUN_DIR into it's own propagation group
>   ipnetns: Make netns mount points private
>
>  ip/ipnetns.c | 12 +++++++++++-
>  1 file changed, 11 insertions(+), 1 deletion(-)

Eric