public inbox for passt-dev@passt.top
 help / color / mirror / code / Atom feed
* [PATCH 0/3] Fix pasta-in-pasta operation (and similar)
@ 2023-05-21 23:41 Stefano Brivio
  2023-05-21 23:41 ` [PATCH 1/3] util, conf: Add and use ns_is_init() helper Stefano Brivio
                   ` (2 more replies)
  0 siblings, 3 replies; 8+ messages in thread
From: Stefano Brivio @ 2023-05-21 23:41 UTC (permalink / raw)
  To: passt-dev; +Cc: David Gibson

When pasta spawns a command (operation without pre-existing namespace),
it calls clone(2) with CLONE_NEWPID to detach the PID namespace where
this command runs, but it needs to mount /proc (in a separate mount
namespace), otherwise its contents are not consistent with the new
PID namespace.

If /proc contents are not consistent, pasta will fail to run in a
user and network namespace created by another pasta instance.

An alternative would be to drop CLONE_NEWPID altogether: pasta
itself not a container engine, and it's not meant to provide general
isolation features other than for networking aspects. This would
also make testing and debugging a bit easier, as the PIDs of
processes descending from pasta would be the same outside the
detached namespace.

However, also for testing and debugging usage itself, we would lose
two advantages: the inner environment looks more observable (from
inside) with CLONE_NEWPID, and we don't need to explicitly clean up
the environment as pasta terminates: see the ugliness of
pasta_ns_cleanup() before commit 0515adceaa8f ("passt, pasta:
Namespace-based sandboxing, defer seccomp policy application"). It
wasn't very robust either.

Now that this part works, note that writing to the uid_map procfs
entry, with 0 as domain for the map, requires (since Linux 5.12)
CAP_SETFCAP in the parent process. We need this mapping to keep the
behaviour consistent with what happens when we run directly from
the init namespace, and to set the ping_group_range sysctl. Keep
CAP_SETFCAP if we're running with UID 0 from a non-init user
namespace.

With this series, pasta finally runs in itself. I checked basic
connectivity inside a dozen of recursively nested instances.


Stefano Brivio (3):
  util, conf: Add and use ns_is_init() helper
  pasta: Detach mount namespace, (re)mount procfs before spawning
    command
  isolation: Initially Keep CAP_SETFCAP if running as UID 0 in non-init

 conf.c      | 16 +---------------
 isolation.c | 17 ++++++++++++++---
 pasta.c     |  7 ++++++-
 util.c      | 25 +++++++++++++++++++++++++
 util.h      |  2 ++
 5 files changed, 48 insertions(+), 19 deletions(-)

-- 
2.39.2


^ permalink raw reply	[flat|nested] 8+ messages in thread

end of thread, other threads:[~2023-05-22  8:50 UTC | newest]

Thread overview: 8+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-05-21 23:41 [PATCH 0/3] Fix pasta-in-pasta operation (and similar) Stefano Brivio
2023-05-21 23:41 ` [PATCH 1/3] util, conf: Add and use ns_is_init() helper Stefano Brivio
2023-05-22  5:41   ` David Gibson
2023-05-22  8:50     ` Stefano Brivio
2023-05-21 23:41 ` [PATCH 2/3] pasta: Detach mount namespace, (re)mount procfs before spawning command Stefano Brivio
2023-05-22  5:42   ` David Gibson
2023-05-21 23:41 ` [PATCH 3/3] isolation: Initially Keep CAP_SETFCAP if running as UID 0 in non-init Stefano Brivio
2023-05-22  5:48   ` David Gibson

Code repositories for project(s) associated with this public inbox

	https://passt.top/passt

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for IMAP folder(s).