lkml.org 
[lkml]   [2016]   [Jul]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [PATCH 0/5 RFC] Add an interface to discover relationships between namespaces
"W. Trevor King" <wking@tremily.us> writes:

2> On Sat, Jul 23, 2016 at 02:38:56PM -0700, James Bottomley wrote:
>> On Sat, 2016-07-23 at 14:14 -0700, W. Trevor King wrote:
>> > namespaces(7) and clone(2) both have:
>> >
>> > When a network namespace is freed (i.e., when the last process
>> > in the namespace terminates), its physical network devices are
>> > moved back to the initial network namespace (not to the parent
>> > of the process).
>> >
>> > So the initial network namespace (the head of net_namespace_list?)
>> > is special [1]. To understand how physical network devices will
>> > be handled, it seems like we want to treat network devices as a
>> > depth-1 tree, with all non-initial net namespaces as children of
>> > the initial net namespace. Can we extend this series'
>> > NS_GET_PARENT to return:
>> >
>> > * EPERM for an unprivileged caller (like this series currently does
>> > for PID namespaces),
>> > * ENOENT when called on net_namespace_list, and
>> > * net_namespace_list when called on any other net namespace.
>>
>> What's the practical application of this? independent net
>> namespaces are managed by the ip netns command. It pins them by a
>> bind mount in a flat fashion; if we make them hierarchical the tool
>> would probably need updating to reflect this, so we're going to need
>> a reason to give the network people. Just having the interfaces not
>> go back to root when you do an ip netns delete doesn't seem very
>> compelling.
>
> I'm not suggesting we add support for deeper nesting, I'm suggesting
> we use NS_GET_PARENT to allow sufficiently privileged users to
> determine if a given net namespace is the initial net namespace. You
> could do this already with something like:
>
> 1. Create a new net namespace.
> 2. Add a physical network device to that namespace.
> 3. Delete that namespace.
> 4. See if the physical network device shows up in your
> initial-net-namespace candidate.
> 5. Delete the physical network device (hopefully it ended up somewhere
> you can find it ;).
>
> But using an NS_GET_PARENT call seems much safer and easier.

Have you had the problem in practice where you can't tell which network
namespace is the initial network namespace. This all seems like a
theoretical problem rather than a real one.

Eric

\
 
 \ /
  Last update: 2016-07-24 00:41    [W:0.072 / U:0.192 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site