Re: [PATCH 0/5 RFC] Add an interface to discover relationships between namespaces
From: Eric W. Biederman
Date: Sat Jul 23 2016 - 18:10:06 EST
"W. Trevor King" <wking@xxxxxxxxxx> writes:
2> On Sat, Jul 23, 2016 at 02:38:56PM -0700, James Bottomley wrote:
>> On Sat, 2016-07-23 at 14:14 -0700, W. Trevor King wrote:
>> > namespaces(7) and clone(2) both have:
>> > When a network namespace is freed (i.e., when the last process
>> > in the namespace terminates), its physical network devices are
>> > moved back to the initial network namespace (not to the parent
>> > of the process).
>> > So the initial network namespace (the head of net_namespace_list?)
>> > is special . To understand how physical network devices will
>> > be handled, it seems like we want to treat network devices as a
>> > depth-1 tree, with all non-initial net namespaces as children of
>> > the initial net namespace. Can we extend this series'
>> > NS_GET_PARENT to return:
>> > * EPERM for an unprivileged caller (like this series currently does
>> > for PID namespaces),
>> > * ENOENT when called on net_namespace_list, and
>> > * net_namespace_list when called on any other net namespace.
>> What's the practical application of this? independent net
>> namespaces are managed by the ip netns command. It pins them by a
>> bind mount in a flat fashion; if we make them hierarchical the tool
>> would probably need updating to reflect this, so we're going to need
>> a reason to give the network people. Just having the interfaces not
>> go back to root when you do an ip netns delete doesn't seem very
> I'm not suggesting we add support for deeper nesting, I'm suggesting
> we use NS_GET_PARENT to allow sufficiently privileged users to
> determine if a given net namespace is the initial net namespace. You
> could do this already with something like:
> 1. Create a new net namespace.
> 2. Add a physical network device to that namespace.
> 3. Delete that namespace.
> 4. See if the physical network device shows up in your
> initial-net-namespace candidate.
> 5. Delete the physical network device (hopefully it ended up somewhere
> you can find it ;).
> But using an NS_GET_PARENT call seems much safer and easier.
Have you had the problem in practice where you can't tell which network
namespace is the initial network namespace. This all seems like a
theoretical problem rather than a real one.