lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <8be364fd938a4ac9959b4c01120cac97@AcuMS.aculab.com> Date: Tue, 4 Oct 2022 08:53:39 +0000 From: David Laight <David.Laight@...LAB.COM> To: "'Eric W. Biederman'" <ebiederm@...ssion.com> CC: Linus Torvalds <torvalds@...ux-foundation.org>, Al Viro <viro@...iv.linux.org.uk>, "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>, "netdev@...r.kernel.org" <netdev@...r.kernel.org>, "Serge E. Hallyn" <serge@...lyn.com> Subject: RE: [CFT][PATCH] proc: Update /proc/net to point at the accessing threads network namespace From: Eric W. Biederman > Sent: 03 October 2022 18:07 > > David Laight <David.Laight@...LAB.COM> writes: > > > From: Eric W. Biederman ... > > Part of the problem is that changing the net namespace isn't > > enough, you also have to remount /sys - which isn't entirely > > trivial. > > Yes. That is actually a much more maintainable model. But it is still > imperfect. I was thinking about the proc/net directories when > I made my comment. Unlike proc where we have task ids there is nothing > in /proc that can do anything. > > > It might be possibly to mount a network namespace version > > of /sys on a different mountpoint - I've not tried very > > hard to do that. > > It is a bug if that doesn't work. The difficultly is picking the 'spell'. I think you need to run mount after switching to the namespace. But you don't want the unshare() that 'ip netns exec' does. So I think it needs a silly wrapper program. > >> > Notwithstanding the apparmor issues, /proc/net could actuall be > >> > a symlink to (say) /proc/net_namespaces/namespace_name with > >> > readlink returning the name based on the threads actual namespace. > >> > >> There really aren't good names for namespaces at the kernel level. As > >> one of their use cases is to make process migration possible between > >> machines. So any kernel level name would need to be migrated as well. > >> So those kernel level names would need a name in another namespace, > >> or an extra namespace would have to be created for those names. > > > > Network namespaces do seem to have names. > > Although I gave up working out how to change to a named network > > namespace from within the kernel (especially in a non-GPL module). > > Network namespaces have mount points. The mount points have names. > > It is just a matter of finding the right filesystem and calling > sys_rename(). I wanted to lookup a net namespace by name - so I could create a kernel socket in a namespace specified in configuration data. Not change the name of a namespace. I ended up only giving a few options - basically saving the namespace of code that called into the driver. (Harder in a non-gpl driver since you can't directly hold/release the namespace itself - fortunately you can create a socket!) David - Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK Registration No: 1397386 (Wales)
Powered by blists - more mailing lists