lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Tue, 4 Oct 2022 08:53:39 +0000
From:   David Laight <David.Laight@...LAB.COM>
To:     "'Eric W. Biederman'" <>
CC:     Linus Torvalds <>,
        Al Viro <>,
        "" <>,
        "" <>,
        "Serge E. Hallyn" <>
Subject: RE: [CFT][PATCH] proc: Update /proc/net to point at the accessing
 threads network namespace

From: Eric W. Biederman
> Sent: 03 October 2022 18:07
> David Laight <David.Laight@...LAB.COM> writes:
> > From: Eric W. Biederman
> > Part of the problem is that changing the net namespace isn't
> > enough, you also have to remount /sys - which isn't entirely
> > trivial.
> Yes.  That is actually a much more maintainable model.  But it is still
> imperfect.    I was thinking about the proc/net directories when
> I made my comment.  Unlike proc where we have task ids there is nothing
> in /proc that can do anything.
> > It might be possibly to mount a network namespace version
> > of /sys on a different mountpoint - I've not tried very
> > hard to do that.
> It is a bug if that doesn't work.

The difficultly is picking the 'spell'.
I think you need to run mount after switching to the namespace.
But you don't want the unshare() that 'ip netns exec' does.
So I think it needs a silly wrapper program.

> >> > Notwithstanding the apparmor issues, /proc/net could actuall be
> >> > a symlink to (say) /proc/net_namespaces/namespace_name with
> >> > readlink returning the name based on the threads actual namespace.
> >>
> >> There really aren't good names for namespaces at the kernel level.  As
> >> one of their use cases is to make process migration possible between
> >> machines.  So any kernel level name would need to be migrated as well.
> >> So those kernel level names would need a name in another namespace,
> >> or an extra namespace would have to be created for those names.
> >
> > Network namespaces do seem to have names.
> > Although I gave up working out how to change to a named network
> > namespace from within the kernel (especially in a non-GPL module).
> Network namespaces have mount points.  The mount points have names.
> It is just a matter of finding the right filesystem and calling
> sys_rename().

I wanted to lookup a net namespace by name - so I could create
a kernel socket in a namespace specified in configuration data.
Not change the name of a namespace.

I ended up only giving a few options - basically saving the
namespace of code that called into the driver.
(Harder in a non-gpl driver since you can't directly hold/release
the namespace itself - fortunately you can create a socket!)


Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)

Powered by blists - more mailing lists