netdev - Re: [PATCH iproute2] netns: make /var/run/netns bind-mount recursive

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 04 Aug 2017 08:41:28 -0500
From:   ebiederm@...ssion.com (Eric W. Biederman)
To:     Stephen Hemminger <stephen@...workplumber.org>
Cc:     Casey Callendrello <casey.callendrello@...eos.com>,
        netdev@...r.kernel.org
Subject: Re: [PATCH iproute2] netns: make /var/run/netns bind-mount recursive

Stephen Hemminger <stephen@...workplumber.org> writes:

> On Tue,  1 Aug 2017 17:46:09 +0200
> Casey Callendrello <casey.callendrello@...eos.com> wrote:
>
>> When ip netns {add|delete} is first run, it bind-mounts /var/run/netns
>> on top of itself, then marks it as shared. However, if there are already
>> bind-mounts in the directory from other tools, these would not be
>> propagated. Fix this by recursively bind-mounting.
>> 
>> Signed-off-by: Casey Callendrello <casey.callendrello@...eos.com>
>> ---
>>  ip/ipnetns.c | 2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>> 
>
> Looks good, but I want a review by Eric to make sure this doesn't
> break other things.

Acked-by: "Eric W. Biederman" <ebiederm@...ssion.com>

I don't see any possible problems with this.  This will just keep all of
the mounts showing up.

It would be really nice if we could at some point detect that a parent
directory is shared (which happens with a common init system) and skip
the steps of the bind mount and making them shared as they are
redundant.  However while that might also solve this issue that is
something for another day.

Eric