netdev - AF_UNIX sockets crossing namespace based boundaries

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAK989ycHNM-rSK9OSvkmhK1jg1Q0bVu4BZE3DQuGown6=MzzFA@mail.gmail.com>
Date:   Tue, 1 Jan 2019 19:46:07 -0500
From:   Donald Sharp <sharpd@...ulusnetworks.com>
To:     netdev@...r.kernel.org, David Ahern <dsa@...ulusnetworks.com>,
        Nicolas Dichtel <nicolas.dichtel@...nd.com>,
        Roopa Prabhu <roopa@...ulusnetworks.com>
Subject: AF_UNIX sockets crossing namespace based boundaries

I have created multiple namespaces:

sharpd@...ot /v/l/frr> ip netns list
two (id: 2)
one (id: 1)
EVA (id: 0)

And am running a process in namespace two that creates a named socket
`/var/log/frr/run/zserv.api`:

sharpd@...ot ~/frr> sudo ip netns exec two /usr/lib/frr/zebra -N two
--daemon -A 127.0.0.1
sharpd@...ot ~/frr> sudo ss -aep -N two | grep frr
u_str LISTEN  0        5               /var/log/frr/run/zserv.api
689118                           * 0
users:(("zebra",pid=14126,fd=16)) <->
u_str LISTEN  0        5           /var/log/frr/run/two/zebra.vty
689120                           * 0
users:(("zebra",pid=14126,fd=20)) <->

in namespace one I create a different process that should attach to
the `/var/log/frr/run/zserv.api` socket, but I have not started a
zebra process to attach to it:

sharpd@...ot ~/frr> sudo ip netns exec one /usr/lib/frr/bgpd -N one -t
-A 127.0.0.1 -n -f /etc/frr/one/bgpd.conf
robot#

The zebra process( in namespace two shows a bgp connection: )
[sharpd@...ot frr]$ sudo tail -F /tmp/frr.two.log
2019/01/01 19:40:30 ZEBRA: client 13 says hello and bids fair to
announce only bgp routes vrf=0

In namespace one we have this:

[sharpd@...ot frr]$ sudo ss -aep -N one | grep frr
u_strLISTEN 0      5       /var/log/frr/run/one/bgpd.vty 708666
       * 0            users:(("bgpd",pid=15318,fd=16)) <->
u_strESTAB  0      0          /var/log/frr/run/zserv.api 707740
       * 708667       users:(("zebra",pid=14126,fd=13)) <->
[sharpd@...ot frr]$

In namespace two we have this:
[sharpd@...ot frr]$ sudo ss -aep -N two | grep frr
u_str LISTEN  0        5               /var/log/frr/run/zserv.api
689118                           * 0
users:(("zebra",pid=14126,fd=16)) <->
u_str LISTEN  0        5           /var/log/frr/run/two/zebra.vty
689120                           * 0
users:(("zebra",pid=14126,fd=20)) <->
[sharpd@...ot frr]$

I am running:
[sharpd@...ot frr]$ uname -a
Linux robot 4.19.10-300.fc29.x86_64 #1 SMP Mon Dec 17 15:34:44 UTC
2018 x86_64 x86_64 x86_64 GNU/Linux
[sharpd@...ot frr]$

When I create a zebra process per namespace all my AF_UNIX connections
end up in the right namespace.  My expectation is that named sockets
should not traverse namespaces.  Is this an invalid assumption?