Re: [PATCH] pasta: wait for netns setup before calling exec

[Stefano Brivio <sbrivio@redhat.com>]

On Wed,  1 Feb 2023 19:01:16 +0100
Paul Holzinger <pholzing@redhat.com> wrote:

> When a user spawns a command with pasta they expect the network to be
> ready. Currently this does not work because pasta will fork/exec
> before it will setup the network config.
> 
> This patch fixes it by using a pipe to sync parent and child. The child
> will now block reading from this pipe before the exec call. The parent
> will then unblock the child only after the netns was configured.

Thanks for the patch! I'm reviewing this in a bit.

A few considerations meanwhile:

- there's actually a bigger issue (you're fixing here) than the
  namespace configuration (via netlink) itself: the tap device isn't
  ready (tap_sock_init() hasn't been called yet) when we spawn the
  command in the new namespace. Oops.

  If you're wondering: we can't just reorder things, because to complete
  the configuration phase (conf()) we need the namespace to be set up,
  and we can't initialise the tap device before it's set up

- pipes are more commonly used to transfer data around (hence the whole
  code you need to open a communication channel, check it, close it).
  Did you try with a signal? Or is there a reason why it wouldn't work?

  You could simply SIGSTOP the child, from the child itself:

	kill(getpid(), SIGSTOP);

  and send a SIGCONT to it (we already store the PID of the child in
  pasta_child_pid) once we're ready.

  SIGCONT is special in that it doesn't need CAP_KILL or the processes
  to run under the same UID -- just in the same session, so it wouldn't
  risk interfering with the isolation_*() calls.

  I haven't tested this but I think it should lead to simpler code.

-- 
Stefano