public inbox for passt-dev@passt.top
 help / color / mirror / code / Atom feed
From: Stefano Brivio <sbrivio@redhat.com>
To: David Gibson <david@gibson.dropbear.id.au>
Cc: passt-dev@passt.top
Subject: Re: [PATCH 07/10] isolation: Replace drop_caps() with a version that actually does something
Date: Thu, 13 Oct 2022 06:01:19 +0200	[thread overview]
Message-ID: <20221013060119.48d51493@elisabeth> (raw)
In-Reply-To: <20221011054018.1449506-8-david@gibson.dropbear.id.au>

On Tue, 11 Oct 2022 16:40:15 +1100
David Gibson <david@gibson.dropbear.id.au> wrote:

> @@ -251,7 +275,19 @@ int isolate_prefork(struct ctx *c)
>  		return -errno;
>  	}
>  
> -	drop_caps();	/* Relative to the new user namespace this time. */
> +	/* Drop capabilites in our new userns */
> +	if (c->mode == MODE_PASTA) {
> +		/* Keep CAP_SYS_ADMIN, so that we can setns() to the
> +		 * netns when we need to act upon it
> +		 */
> +		ns_caps |= 1UL << CAP_SYS_ADMIN;
> +		/* Keep CAP_NET_BIND_SERVICE, so we can splice
> +		 * outbound connections to low port numbers
> +		 */
> +		ns_caps |= 1UL << CAP_NET_BIND_SERVICE;
> +	}
> +
> +	drop_caps_ep_except(ns_caps);

Hmm, I didn't really look into this yet, but there seems to be an issue
with filesystem-bound network namespaces now. Running something like:

  pasta --config-net --netns /run/user/1000/netns/netns-6466ff4b-1efc-2b58-685b-cbc12feb9ccc

(from Podman), this happens:

readlink("/proc/self/exe", "/usr/local/bin/passt.avx2", 4095) = 25
capget({version=_LINUX_CAPABILITY_VERSION_3, pid=0}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_N
 ET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
capset({version=_LINUX_CAPABILITY_VERSION_3, pid=0}, {effective=1<<CAP_NET_BIND_SERVICE, permitted=1<<CAP_NET_BIND_SERVICE, inheritable=0}) = 0

[...]

getegid()                               = 0
openat(AT_FDCWD, "/proc/self/uid_map", O_RDONLY|O_CLOEXEC) = 7
read(7, "         0       1000          1"..., 8192) = 66
close(7)                                = 0
setgroups(0, NULL)                      = -1 EPERM (Operation not permitted)
setgid(0)                               = 0
setuid(0)                               = 0
openat(AT_FDCWD, "/run/user/1000/netns/netns-6466ff4b-1efc-2b58-685b-cbc12feb9ccc", O_RDONLY|O_CLOEXEC) = 7
clone(child_stack=0x7ffef5a229a0, flags=CLONE_VM|CLONE_FILES|CLONE_VFORK|SIGCHLDstrace: Process 1763223 attached
 <unfinished ...>
[pid 1763223] setns(7, CLONE_NEWNET)    = -1 EPERM (Operation not permitted)
[pid 1763223] exit(0)                   = ?
[pid 1763222] <... clone resumed>)      = 1763223
[pid 1763223] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=1763223, si_uid=0, si_status=0, si_utime=0, si_stime=0} ---
waitid(P_ALL, 0, NULL, WNOHANG|WEXITED, NULL) = 0
waitid(P_ALL, 0, NULL, WNOHANG|WEXITED, NULL) = -1 ECHILD (No child processes)
rt_sigreturn({mask=[]})                 = 1763223
sendto(5, "<3> Couldn't switch to pasta nam"..., 40, 0, NULL, 0) = 40
write(2, "Couldn't switch to pasta namespa"..., 35Couldn't switch to pasta namespaces) = 35
write(2, "\n", 1

-- 
Stefano


  parent reply	other threads:[~2022-10-13  4:01 UTC|newest]

Thread overview: 33+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-10-11  5:40 [PATCH 00/10] Fixes and cleanups for capability handling David Gibson
2022-10-11  5:40 ` [PATCH 01/10] test: Move slower tests to end of test run David Gibson
2022-10-11  5:40 ` [PATCH 02/10] pasta: More general way of starting spawned shell as a login shell David Gibson
2022-10-13  2:16   ` Stefano Brivio
2022-10-13  8:22     ` David Gibson
2022-10-13  9:48       ` Stefano Brivio
2022-10-13 23:24         ` David Gibson
2022-10-11  5:40 ` [PATCH 03/10] pasta_start_ns() always ends in parent context David Gibson
2022-10-11  5:40 ` [PATCH 04/10] Remove unhelpful drop_caps() call in pasta_start_ns() David Gibson
2022-10-11  5:40 ` [PATCH 05/10] Clarify various self-isolation steps David Gibson
2022-10-13  2:17   ` Stefano Brivio
2022-10-13  8:31     ` David Gibson
2022-10-13 12:49   ` Stefano Brivio
2022-10-13 23:25     ` David Gibson
2022-10-11  5:40 ` [PATCH 06/10] Replace FWRITE with a function David Gibson
2022-10-13  2:17   ` Stefano Brivio
2022-10-13  8:51     ` David Gibson
2022-10-11  5:40 ` [PATCH 07/10] isolation: Replace drop_caps() with a version that actually does something David Gibson
2022-10-13  2:18   ` Stefano Brivio
2022-10-13  9:44     ` David Gibson
2022-10-13  4:01   ` Stefano Brivio [this message]
2022-10-13 13:08     ` Stefano Brivio
2022-10-13 16:37       ` Stefano Brivio
2022-10-13 23:42         ` David Gibson
2022-10-11  5:40 ` [PATCH 08/10] isolation: Prevent any child processes gaining capabilities David Gibson
2022-10-13  2:17   ` Stefano Brivio
2022-10-13  9:33     ` David Gibson
2022-10-13  9:50       ` Stefano Brivio
2022-10-11  5:40 ` [PATCH 09/10] isolation: Only configure UID/GID mappings in userns when spawning shell David Gibson
2022-10-13  2:18   ` Stefano Brivio
2022-10-13  9:36     ` David Gibson
2022-10-11  5:40 ` [PATCH 10/10] Rename pasta_setup_ns() to pasta_spawn_cmd() David Gibson
2022-10-13  2:44 ` [PATCH 00/10] Fixes and cleanups for capability handling Stefano Brivio

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20221013060119.48d51493@elisabeth \
    --to=sbrivio@redhat.com \
    --cc=david@gibson.dropbear.id.au \
    --cc=passt-dev@passt.top \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
Code repositories for project(s) associated with this public inbox

	https://passt.top/passt

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for IMAP folder(s).