netdev - re: [PATCH 3/4] proc: Point /proc/net at /proc/thread-self/net instead of /proc/self/net

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 29 Sep 2022 15:22:10 +0000
From:   David Laight <David.Laight@...LAB.COM>
To:     "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>
CC:     "Eric W. Biederman" <ebiederm@...ssion.com>,
        "Serge E. Hallyn" <serge@...lyn.com>,
        Linus Torvalds <torvalds@...ux-foundation.org>
Subject: re: [PATCH 3/4] proc: Point /proc/net at /proc/thread-self/net
 instead of /proc/self/net

I've just bumped into (the lack of) this change (from aug 2014):

> In oddball cases where the thread has a different network namespace
> than the primary thread group leader or more likely in cases where
> the thread remains and the thread group leader has exited this
> ensures that /proc/net continues to work.

> -	proc_symlink("net", NULL, "self/net");
> +	proc_symlink("net", NULL, "thread-self/net");

This was applied and then reverted by Linus (I can't find anything
in the LKML archive) - see git show 155134fef - because of
issues with apparmor and dhclient.

In my case we have an application that is started in one
network namespace (where most of what it needs to do exists)
but needs one thread to revert to the 'init' namespace in
order to accept TCP connections from applications.

The thread that reverts is the main thread.
Until a change made in the last 6 months it actually worked.
(I'm using 5.10 LTS kernels so I'm not sure when.)
Then a fix was made to correctly update the mounts when the
namespace changed - and it suddenly stopped working.

So the 'oddball' case of different threads being in different
namespaces and then accessing /proc/net (because that is what
the code always did before being changed to run in a namespace)
has happened to a real application.

Fortunately it happened in testing and the application could
be changed.

(I was looking at the kernel sources to propose the change
that got reverted!)

	David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)