From mboxrd@z Thu Jan  1 00:00:00 1970
From: Stefano Brivio <sbrivio@redhat.com>
To: passt-dev@passt.top
Subject:
 Re: [PATCH v2 08/10] Correctly handle --netns-only in pasta_start_ns()
Date: Tue, 13 Sep 2022 05:50:15 +0200
Message-ID: <20220913055015.274d090e@elisabeth>
In-Reply-To: <Yx2bt+/QuPiEDZ3l@yekko>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============5047069653656159925=="

--===============5047069653656159925==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

On Sun, 11 Sep 2022 18:26:31 +1000
David Gibson <david(a)gibson.dropbear.id.au> wrote:

> On Sat, Sep 10, 2022 at 05:25:36PM +1000, David Gibson wrote:
> > On Fri, Sep 09, 2022 at 04:34:20PM +0200, Stefano Brivio wrote: =20
> > > On Thu,  8 Sep 2022 13:59:05 +1000
> > > David Gibson <david(a)gibson.dropbear.id.au> wrote:
> > >  =20
> > > > --netns-only is supposed to make pasta use only a network namespace, =
not
> > > > a user namespace.  However, pasta_start_ns() has this backwards, and =
if
> > > > --netns-only is specified it creates a user namespace but *not* a net=
work
> > > > namespace.  Correct this.
> > > >=20
> > > > Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au>
> > > > ---
> > > >  pasta.c | 4 ++--
> > > >  1 file changed, 2 insertions(+), 2 deletions(-)
> > > >=20
> > > > diff --git a/pasta.c b/pasta.c
> > > > index 0fd45e4..7eac8e9 100644
> > > > --- a/pasta.c
> > > > +++ b/pasta.c
> > > > @@ -244,8 +244,8 @@ void pasta_start_ns(struct ctx *c, int argc, char=
 *argv[])
> > > > =20
> > > >  	pasta_child_pid =3D clone(pasta_setup_ns,
> > > >  				ns_fn_stack + sizeof(ns_fn_stack) / 2,
> > > > -				(c->netns_only ? 0 : CLONE_NEWNET) |
> > > > -				CLONE_NEWIPC | CLONE_NEWPID | CLONE_NEWUSER |
> > > > +				(c->netns_only ? 0 : CLONE_NEWUSER) |
> > > > +				CLONE_NEWIPC | CLONE_NEWPID | CLONE_NEWNET | =20
> > >=20
> > > Oh, funny, so it never worked in this case.
> > >=20
> > > I thought anyway your plan was to drop --netns-only altogether, and if
> > > a --netns option is specified without --userns, then it's implied. Is
> > > that still on the table (outside the scope of this series I presume)?  =

> >=20
> > Well.. having reduced the lifetome of netns_only to within conf()
> > alone, I felt a lot less urgency about removing it entirely.  It might
> > still be nicer to remove it anyway; I'll have another look. =20
>=20
> Actually, I realized there is a reason to leave it in: just using
> --netns doesn't work with spawning a command, and spawning a command
> with netns but no userns might be useful.

Right, thanks for noticing, that combination didn't occur to me at all.

--=20
Stefano


--===============5047069653656159925==--