netdev - [PATCH] iptables: Per-net ns lock

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 20 Apr 2018 16:42:47 +0300
From:   Kirill Tkhai <ktkhai@...tuozzo.com>
To:     fw@...len.de, netdev@...r.kernel.org, pablo@...filter.org,
        rstoyanov1@...il.com, ptikhomirov@...tuozzo.com,
        avagin@...tuozzo.com, ktkhai@...tuozzo.com
Subject: [PATCH] iptables: Per-net ns lock

Containers want to restore their own net ns,
while they may have no their own mnt ns.
This case they share host's /run/xtables.lock
file, but they may not have permission to open
it.

Patch makes /run/xtables.lock to be per-namespace,
i.e., to refer to the caller task's net ns.

Signed-off-by: Kirill Tkhai <ktkhai@...tuozzo.com>
---
 iptables/xshared.c |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/iptables/xshared.c b/iptables/xshared.c
index 06db72d4..b6dbe4e7 100644
--- a/iptables/xshared.c
+++ b/iptables/xshared.c
@@ -254,7 +254,12 @@ static int xtables_lock(int wait, struct timeval *wait_interval)
 	time_left.tv_sec = wait;
 	time_left.tv_usec = 0;
 
-	fd = open(XT_LOCK_NAME, O_CREAT, 0600);
+	if (symlink("/proc/self/ns/net", XT_LOCK_NAME) != 0 &&
+	    errno != EEXIST) {
+		fprintf(stderr, "Fatal: can't create lock file\n");
+		return XT_LOCK_FAILED;
+	}
+	fd = open(XT_LOCK_NAME, O_RDONLY);
 	if (fd < 0) {
 		fprintf(stderr, "Fatal: can't open lock file %s: %s\n",
 			XT_LOCK_NAME, strerror(errno));