netdev - Re: AF_UNIX sockets crossing namespace based boundaries

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 2 Jan 2019 10:22:36 -0500
From:   Donald Sharp <sharpd@...ulusnetworks.com>
To:     Andrew Lunn <andrew@...n.ch>
Cc:     netdev@...r.kernel.org, David Ahern <dsa@...ulusnetworks.com>,
        Nicolas Dichtel <nicolas.dichtel@...nd.com>,
        Roopa Prabhu <roopa@...ulusnetworks.com>
Subject: Re: AF_UNIX sockets crossing namespace based boundaries

I am only creating a network namespace, but I don't think this changes
my core question.

Suppose I am running FRR/zebra in the default namespace and I startup
a BGP instance in namespace one.  BGP will connect to the default
namespaces zebra instance.
Now suppose I am running FRR/zebra in the default namespace and
FRR/zebra in namespace two and I startup a BGP instance in namespace
one, BGP is connecting to the zebra instance in namespace two now.
Finally if I run zebra in namespace one and then start a bgp instance
in one, it connects to the zebra running in namespace one.

Is this the behavior we want to see?  I also haven't tested to see
which namepace gets choosen if I have multiple zebra instances running
in different namespaces and I startup a bgp process in a namespace
that doesn't have zebra also running.  Or does start order matter
here?

thanks!

donald

Is this the behavior we actually want?

On Wed, Jan 2, 2019 at 9:05 AM Andrew Lunn <andrew@...n.ch> wrote:
>
> On Tue, Jan 01, 2019 at 07:46:07PM -0500, Donald Sharp wrote:
> > I have created multiple namespaces:
> >
> > sharpd@...ot /v/l/frr> ip netns list
> > two (id: 2)
> > one (id: 1)
> > EVA (id: 0)
> >
> > And am running a process in namespace two that creates a named socket
> > `/var/log/frr/run/zserv.api`:
>
> Hi Donald
>
> Just to be sure...
>
> Are you creating only a network name space, and not a filesystem mount
> namespace?
>
> I've successfully run hundred of FRR daemons in namespaces on Linux
> for simulation work, but i always use both a network namespace and
> mount namespace. /var/log/frr/run/zserv.api is clearly a filesystem
> path, so you need to separate these at the filesystem level.
>
>        Andrew