netdev - Re: RFC: bring UP 'lo' by default after creating new netns

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAF2d9jg1P2AVOJ+FT+pRGjG0HW1YCRN9+WQ7xK67banby7EMng@mail.gmail.com>
Date:   Thu, 29 Jun 2017 23:26:46 -0700
From:   Mahesh Bandewar (महेश बंडेवार) 
        <maheshb@...gle.com>
To:     "Eric W. Biederman" <ebiederm@...ssion.com>
Cc:     Eric Dumazet <edumazet@...gle.com>, adobriyan@...il.com,
        David Miller <davem@...emloft.net>, xiyou.wangcong@...il.com,
        linux-netdev <netdev@...r.kernel.org>
Subject: Re: RFC: bring UP 'lo' by default after creating new netns

On Thu, Jun 29, 2017 at 6:08 PM, Eric W. Biederman
<ebiederm@...ssion.com> wrote:
> "Mahesh Bandewar (महेश बंडेवार)" <maheshb@...gle.com> writes:
>
>> Creation of new network namespace is almost always followed up by
>> bringing up the loopback device.
>>
>>         ip netns add foo
>>         ip -netns foo link set lo up
>>
>> I'm not sure if there are any consequences of bringing the device UP
>> at the creation of network-namespace.jjh
>
> Hard coded in net/core/net_namespace.c:copy_net_ns is definitely the
> wrong place in the code for something like this.  If this lives anywhere
> it should live in driver/net/loopback.c, or possibly in
> net/core/dev.c:net_dev_init.
>
interestingly dev_open() needs RTNL while it's not recommended at
net_dev_init() time.
Also net_dev_init() is called at the sub-system registration, do you
mean loopback_net_init() time?

> If we want this we want to match what we do when we the primary network
> namespace.  Just so that there are no unneeded surprises with network
> namespaces.
>
Yes, correct, it should be same whether it's init-net or some other. I
can add the IFF_UP flag during
loopback_setup() but then it will not perform anything that is done
during dev_open() phase. I'll try
moving the code to loopback_net_init() to achieve the same result so
that I can avoid that hard-coding too.

Thanks for comments Eric.

--mahesh..

> Eric