From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=fail (p=quarantine dis=none) header.from=redhat.com Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by passt.top (Postfix) with ESMTPS id E839B5A0272 for ; Wed, 11 Nov 2026 08:03:46 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1794380625; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=7B7PZW7iKckBSs4dsKhml9jlnaQGc1LMz798belJ7wQ=; b=acEBuUrDI++ctzgRmdVgbYacKCb+1FSn9LeI1qBAT1oZF7IvonfPAn6mQA3sdFOlFQuWN7 DiYnOSRhSrWISpU9kuYee21H4Aeb3miFJaG/9W4yiRxWRWG0M+scrxY3WBZJcCyl9LzABw 1KcEzWIWnRt1JR77Oz1ktc04Nx9B9Wg= Received: from mail-wm1-f71.google.com (mail-wm1-f71.google.com [209.85.128.71]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-691-1yoKphi_M36vyQD3fPOIwA-1; Wed, 11 Nov 2026 02:03:42 -0500 X-MC-Unique: 1yoKphi_M36vyQD3fPOIwA-1 X-Mimecast-MFC-AGG-ID: 1yoKphi_M36vyQD3fPOIwA_1794380621 Received: by mail-wm1-f71.google.com with SMTP id 5b1f17b1804b1-4a80bd45e1cso16047635e9.3 for ; Tue, 10 Nov 2026 23:03:41 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794380621; x=1794985421; h=date:content-transfer-encoding:content-type:mime-version :organization:references:in-reply-to:message-id:subject:cc:to:from :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to:content-type; bh=7B7PZW7iKckBSs4dsKhml9jlnaQGc1LMz798belJ7wQ=; b=U8Zh+TRe8U98/w81N+deI/vw1p8aw7Kp8UmJ92KCB6p3D3Wb7vuQi4tDQKF3A3FT9S duXGEIZPvXTcYmP8Qt33vua1akY6cEJr84tVc2SBsO38KyM5+i510DSkMc4byB8zmfZw tXPvvtpOvSQh20nLQRl6g6hQIykJ6Hn68L/KgkD7IN2lzD3nUErJ5nXMt5s2CMMuIVP8 N6UR5ZgmOqiPoWrTKwtHfTrGoTsFIopmYYFWO7wKsj2y/ZNm+H/sNiHSoLb7s4AyhAaq pr+oCAhpWItJhuc+QNGZH01VgaGnfPZifu39YuqM2efPSYcfM9cOUJqGLWqWVXXwu4DO HOmw== X-Gm-Message-State: APuU4Z8ShVoW17GQeKS7QQ8DhBfUMgRUYnwDK1cISfz3NTO7A+xc5BX6 +o739z3kpKdlCFstDk8IWN35s9xFvU5c9TzBFTJ2q2CtjHzekj03XlicfJ3wSGLc0lQvUIdJPvt Pi9Ak1xpgxGKUBAQoqRX7+MOtKAVTdqIyrqXVVPLNgRVt74VGhG0t5fXhWT2iRof/U7KCJJw19k lt/Xu7DJ6XqRE4hLe2YaS4dFk+MudSqbh6Np+j X-Gm-Gg: AYBFou3WoPkwNavY/U6uy/DJsQA/xX/ZhJFvfE3O/bzs8OH/uaL44epoe87VGvxtsdO 4LcCkJhFKlaHzTRMDgaj7tbOZOQAAYc5W5Qu+bjIoLbSGGM5Bs2470Z7hpYcQbnJ3+BUUGejt26 ZIUJ2XocvQ3Kf/jNmH1cCGYnsM2Jcxgi6jhtL5w8f/LB2XPv5KYzE4u8hWR/VFwuuKS2mn+foOp aBHPMy4Di/ygut4U+b6RscijIQdBdDNGtXNIQQF2gVMAbDV/Rk77fTvnDUwMnASZGs1zxf9P3B6 QLa+icHLhCT8EODougfaXRGT9JljMy3tf5v1q0tPSMrdkkPY0mSWwL4NhcHcYYBOGE5zNbNX84Y gpriuSa2FeAai1XJFMSAEnSzh8vtZDbg780vKeqqTDDCAtzojg7b12B8014xTEf5axsQ= X-Received: by 2002:a05:600c:8718:b0:4a2:150f:1613 with SMTP id 5b1f17b1804b1-4ba093811e1mr21768185e9.7.1794380620406; Tue, 10 Nov 2026 23:03:40 -0800 (PST) X-Received: by 2002:a05:600c:8718:b0:4a2:150f:1613 with SMTP id 5b1f17b1804b1-4ba093811e1mr21767685e9.7.1794380619861; Tue, 10 Nov 2026 23:03:39 -0800 (PST) Received: from maya.myfinge.rs (ifcgrfdd.trafficplex.cloud. [2a10:fc81:a806:d6a9::1]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ba0223c41csm119192845e9.14.2026.11.10.23.03.35 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 10 Nov 2026 23:03:35 -0800 (PST) From: Stefano Brivio To: Richard Lawrence Subject: Re: [PATCH v4] pasta: Add --pass-fds option to skip closing file descriptors Message-ID: <20261111080334.17920495@elisabeth> In-Reply-To: <20261104202019.452348-1-rlawrence@tamu.edu> References: <20261104202019.452348-1-rlawrence@tamu.edu> Organization: Red Hat X-Mailer: Claws Mail 4.2.0 (GTK 3.24.49; x86_64-pc-linux-gnu) MIME-Version: 1.0 Date: Wed, 11 Nov 2026 08:03:35 +0100 (CET) X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: CUwbPPB3_BnmiVMaIxTUa7WHubDaSykUvg4nIU5SKRg_1794380621 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Message-ID-Hash: UB7OR6ZSE55JSZENW4S4XRAQE3BOLQPW X-Message-ID-Hash: UB7OR6ZSE55JSZENW4S4XRAQE3BOLQPW X-MailFrom: sbrivio@redhat.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: passt-dev@passt.top X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: On Wed, 4 Nov 2026 14:20:19 -0600 Richard Lawrence wrote: > When pasta spawns a command (`pasta [options] -- [command]`), all open file > descriptors inherited from the parent process except standard streams (0-2) > and the tap descriptor (`--fd`) are normally closed by `isolate_fds()`. > > However, when pasta is used for testing, development, or launching tools like > Bubblewrap (`bwrap`), the spawned command may require file descriptors > passed directly from the parent process. In this case, closing inherited file > descriptors breaks expected behavior. > > Add a boolean `--pass-fds` flag for pasta mode that skips the `close_range()` > cleanup step in `isolate_fds()`, leaving all open file descriptors intact > for the child command. > > Summary of changes: > > - Update `conf_tap_fd()` to `conf_fds()`, allowing early parsing of both > `-F`/`--fd` and `--pass-fds` before main option processing. > - Update `isolate_fds()` to check `c->pass_fds`: if set, skip calling > `close_range()` while still relocating the tap fd out of standard stream > range (0-2) if needed. > - Enforce validation in `conf()` ensuring `--pass-fds` is restricted to pasta > mode when spawning a command (incompatible with attaching to an > existing netns). > - Update man page and usage help output. > > Link: https://bugs.passt.top/show_bug.cgi?id=204 > Signed-off-by: Richard Lawrence Applied, sorry it took so long. Thanks for sticking to this, and welcome to the git log! By the way, I took the liberty to fix a couple of minor coding style issues on merge: > --- > conf.c | 55 ++++++++++++++++++++++++++---------------- > conf.h | 2 +- > isolation.c | 69 +++++++++++++++++++++++++++++++---------------------- > isolation.h | 2 +- > passt.1 | 5 ++++ > passt.c | 2 +- > passt.h | 2 ++ > 7 files changed, 84 insertions(+), 53 deletions(-) > > diff --git a/conf.c b/conf.c > index 149a4c7..9f7eafb 100644 > --- a/conf.c > +++ b/conf.c > @@ -750,7 +750,8 @@ pasta_opts: > " Don't copy all addresses to namespace\n" > " --ns-mac-addr ADDR Set MAC address on tap interface\n" > " --no-splice Disable inbound socket splicing\n" > - " --splice-only Only enable loopback forwarding\n"); > + " --splice-only Only enable loopback forwarding\n" > + " --pass-fds Preserve open file descriptors\n"); > > passt_exit(status); > } > @@ -1137,35 +1138,38 @@ static void conf_sock_listen(const struct ctx *c) > } > > /** > - * conf_tap_fd() - Read tap fd as supplied by -F command line option > + * conf_fds() - Read fds as supplied by -F/--fd and --pass-fds options > + * @c: Execution context > * @argc: Argument count > * @argv: Command line options > - * > - * Return: fd number from --fd option, or -1 if not supplied > */ > -int conf_tap_fd(int argc, char **argv) > +void conf_fds(struct ctx *c, int argc, char **argv) > { > - const struct option optfd[] = { { "fd", required_argument, NULL, 'F' }, > - { 0 }, }; > - const char *fdarg = NULL, *p; > - unsigned long val; > + const struct option opt[] = { > + { "fd", required_argument, NULL, 'F' }, > + { "pass-fds", no_argument, NULL, 2 }, > + { 0 }, > + }; > int name; > > + c->fd_tap = -1; > + c->pass_fds = false; > optind = 0; > do { > - name = getopt_long(argc, argv, "-:F:", optfd, NULL); > - if (name == 'F') > - fdarg = optarg; > - } while (name != -1); > - > - if (!fdarg) > - return -1; > + name = getopt_long(argc, argv, "-:F:", opt, NULL); > + if (name == 'F') { > + const char *p = optarg; > + unsigned long val; > > - p = fdarg; > - if (!parse_unsigned(&p, 0, &val) || !parse_eoi(p) || val > INT_MAX) > - die("Invalid --fd: %s", fdarg); > + if (!parse_unsigned(&p, 0, &val) || !parse_eoi(p) || > + val > INT_MAX) > + die("Invalid --fd: %s", optarg); > > - return val; > + c->fd_tap = (int)val; > + } else if (name == 2) { > + c->pass_fds = true; > + } > + } while (name != -1); > } > > /** > @@ -1317,6 +1321,7 @@ void conf(struct ctx *c, int argc, char **argv) > {"conf-path", required_argument, NULL, 'c' }, > {"chroot-fallback", no_argument, NULL, 32 }, > {"no-pidns", no_argument, NULL, 33 }, > + {"pass-fds", no_argument, NULL, 34 }, > { 0 }, > }; > const char *optstring = "+dqfel:hs:c:F:I:p:P:m:a:n:M:g:i:o:D:S:H:461t:u:T:U:"; > @@ -1567,6 +1572,11 @@ void conf(struct ctx *c, int argc, char **argv) > > c->no_pidns = true; > break; > + case 34: > + /* --pass-fds was parsed early */ > + if (c->mode != MODE_PASTA) > + die("--pass-fds is for pasta mode only"); > + break; > case 'd': > c->debug = 1; > c->quiet = 0; > @@ -1603,7 +1613,7 @@ void conf(struct ctx *c, int argc, char **argv) > c->fd_control_listen = c->fd_control = -1; > break; > case 'F': > - /* --fd was parsed early and c->fd_tap set in main() */ > + /* --fd was parsed early */ > c->one_off = true; > *c->sock_path = 0; > break; > @@ -1929,6 +1939,9 @@ void conf(struct ctx *c, int argc, char **argv) > else if (optind != argc) > die("Extra non-option argument: %s", argv[optind]); > > + if (c->pass_fds && *netns) > + die("--pass-fds can only be used when spawning a command"); > + > if (c->no_pidns && *netns) > die("--no-pidns is incompatible with PID or --netns"); > > diff --git a/conf.h b/conf.h > index 19bf9bc..654fd16 100644 > --- a/conf.h > +++ b/conf.h > @@ -7,7 +7,7 @@ > #define CONF_H > > enum passt_modes conf_mode(int argc, char *argv[]); > -int conf_tap_fd(int argc, char **argv); > +void conf_fds(struct ctx *c, int argc, char **argv); > void conf(struct ctx *c, int argc, char **argv); > void conf_listen_handler(struct ctx *c, uint32_t events); > void conf_handler(struct ctx *c, uint32_t events); > diff --git a/isolation.c b/isolation.c > index a00475f..1875e6b 100644 > --- a/isolation.c > +++ b/isolation.c > @@ -250,46 +250,57 @@ void isolate_initial(void) > } > > /* > - * isolate_fds() - Close leaked files, but not --fd, stdin, stdout, stderr > + * isolate_fds() - Close leaked files if applicable > + * @c: Execution context > * @argc: Argument count > - * @argv: Command line options, as we need to skip any file given via --fd > + * @argv: Command line options > * > * Should: > - * - close all open files except for standard streams and the one from --fd > + * - close all open files except for standard streams and the one from --fd, > + unless --pass-fds is used, in which case all fds are preserved a missing * here, > * - move the --fd descriptor out of the range 0-2 > - * > - * Return: new fd number for descriptor from --fd, or -1 if not specified > + * - update the execution context > */ > -int isolate_fds(int argc, char **argv) > +void isolate_fds(struct ctx *c, int argc, char **argv) > { > - int fd, close_from = STDERR_FILENO + 1; > + conf_fds(c, argc, argv); > > - fd = conf_tap_fd(argc, argv); > + if (c->pass_fds) { > + if (c->fd_tap >= 0 && c->fd_tap < STDERR_FILENO + 1) { > + /* Move the tap fd to a safer location */ > + int new_fd = fcntl(c->fd_tap, F_DUPFD, STDERR_FILENO + 1); line wrapping here, > > - if (fd >= 0) { > - /* Move the passed fd to a more convenient location */ > - if (fd != close_from && > - (dup2(fd, close_from) != close_from || > - close(fd))) > - die_perror("Could not move --fd descriptor"); > - fd = close_from++; > - } > + if (new_fd < 0 || close(c->fd_tap)) > + die_perror("Could not relocate --fd descriptor"); and here, > + c->fd_tap = new_fd; > + } > + } else { > + int close_from = STDERR_FILENO + 1; > + > + if (c->fd_tap >= 0) { > + /* Move the tap fd to a more convenient location */ > + if (c->fd_tap != close_from && > + (dup2(c->fd_tap, close_from) != close_from || > + close(c->fd_tap))) vertical alignment here, > + die_perror("Could not move --fd descriptor"); > + c->fd_tap = close_from++; > + } > > - if (close_range(close_from, ~0U, CLOSE_RANGE_UNSHARE)) { > - if (errno == ENOSYS || errno == EINVAL) { > - /* This probably means close_range() or the > - * CLOSE_RANGE_UNSHARE flag is not supported by the > - * kernel. Not much we can do here except carry on and > - * hope for the best. > - */ > - warn( > -"Can't use close_range() to ensure no files leaked by parent"); > - } else { > - die_perror("Failed to close files leaked by parent"); > + /* Close leaked file descriptors */ > + if (close_range(close_from, ~0U, CLOSE_RANGE_UNSHARE)) { > + if (errno == ENOSYS || errno == EINVAL) { > + /* This probably means close_range() or the > + * CLOSE_RANGE_UNSHARE flag is not supported by the > + * kernel. Not much we can do here except carry on and > + * hope for the best. line wrapping here, > + */ > + warn( > + "Can't use close_range() to ensure no files leaked by parent"); and this, which was supposed to be at the beginning of the line. > + } else { > + die_perror("Failed to close files leaked by parent"); > + } > } > } > - > - return fd; > } > > /** -- Stefano