From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=fail (p=none dis=none) header.from=gmail.com Received: from mail-dy1-x1331.google.com (mail-dy1-x1331.google.com [IPv6:2607:f8b0:4864:20::1331]) by passt.top (Postfix) with ESMTPS id 80EAC5A061B for ; Fri, 13 Nov 2026 12:21:39 +0100 (CET) Received: by mail-dy1-x1331.google.com with SMTP id 5a478bee46e88-37628596783so1482025eec.1 for ; Fri, 13 Nov 2026 03:21:39 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1794568898; x=1795173698; darn=passt.top; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=jf+jTNrFPVPRNFpdIgF4CJBQK4hiHdr4ALsROkM3b3k=; b=o6gGtxlH8UpqPlXky/jPgHbHDLucvpvr3mAY3AGKGvTRsKyjHQs3YfkNSqP2elav/I +oAVfGim5fmRoPtaFLlmYn3U3SSK+4ViRUpBuMKBKFZP1x83c4tpvPl3TF66enuMeW0M M5BTVaxcb5nUjUeSKDCimmKBTStGwP7gBawRUQkUGaSdJjw38ADstTzGSVMNlzY9au+0 EZrciYy9c6kJarQF0OZy4JS4e286O6KH47VHnT/OFZjD2wOmVn8BqSQjy0Qy2ky91ghg wTuRgMwASviDjlKBJB9k/YuilVEmecBFz/nPOz42/C1Ne2Agfa+iAmvGwqcR217sV8hl y5oQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794568898; x=1795173698; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=jf+jTNrFPVPRNFpdIgF4CJBQK4hiHdr4ALsROkM3b3k=; b=wAxj0Ufg50y6fdvoECxZH1TYWFQuDv6JBxL6GeyHsJGYGY6w4f5pcp0kiA7JoaNF5n LeY5ZwoD0SIrYJiGDSi9Oxc9SOBOxjue6sNfZdld7WY9VcBlXccxT1y/1Kjjy/y9GiyP 2Ekg7NtyEZjcftRSAEE1QIy05oUYmgyev4LATi8JSmDH3hx5IgftCgHR6FFxvfVH+N4Y zWOj5HYHgpuzySsiYi7fOWUCV3F8J581R3EXYeV6iBCdCI9EG29aKBwphHoXHv3cWteN RH5Z2cS/ixZaMiAsHuUJsh5BC+5+etw9j2T8wbnEXVmNvLC8HH6YJNJfbdVQinQNx1Wi 1mPg== X-Gm-Message-State: APuU4Z/q9JhLW4X5vv/LX4uU26u4svgSMfYGo5G+Z6KYaR4jNZZBO3e+ 9YOikpqt7J6Ni9fFnlWVlZtwUb0OdXSKAQPh/1Po7zVUHH9jPe1dgl3y X-Gm-Gg: AYBFou0eCk7SEZ1BF+9AiPAypJrP1x/KcYEmdPKO1Zl4rQzqlqV9ToHvE22Vty6FkXh KaApvg1tFEcPwMWIVGVRqpwDDgFkOyN08oymKO4fcPzo6vc9o5+0lCo2Dw1AWjxBjiEhm1ZASY9 NpfWr3C1yhrYG27zGRmzMZ2ylWxQq31O1XbD4NMIshdiIX+DRSSh6P/acMiqK4a2BizEmi+SXis Dks9pZM+qVSCOusGD28tQNm3SZXM9w7J4YZN9aMbpwPt5ZxJ+e/z9yNscMDzkrwM5X8QgSifg0E Q+OwgrwIJBJCT3R99ZFB+xRDJZFau6uJy81jgObrplXCWTqRcyF6uE0/tie9GpcMEXu0Xzeh6ns 3p4PXEPhO0OmiF46g5U/cCcWK1I1DWFEsoKPy0x6MfU4X7jAo0mrji6tr9miSIAKgKq8LX0y1/R Fh06LE4rLIxnKW2jclJfsYJYFK42/ZyESciaHyboUyr+t1n6jo0QCU2y+eosAPYCFCz0d8SrMmy YUrLvgo4XVYLNT3vkZmdL9hOA4CgIb4wguWyPEMfDmSg1R9x0Z/SM9INL3UjYvrHR51qHrENHbB rZqr2/WSqhkXerYeGX7u5sa2DqokYPI15dwZ6sBJviYqm1wjo5y9SQ6pyaZvBmjLtYtHfixC38d HpjUt2+w= X-Received: by 2002:a05:7022:299:20b0:1a9:cad6:5b58 with SMTP id a92af1059eb24-1b503150119mr2095868c88.39.1794568896750; Fri, 13 Nov 2026 03:21:36 -0800 (PST) Received: from localhost ([2405:201:7:7:2843:7bd:92d7:9f87]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-1b50319d40asm6342858c88.11.2026.11.13.03.21.34 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Fri, 13 Nov 2026 03:21:35 -0800 (PST) From: Aditya Merchant To: Stefano Brivio Subject: Re: [PATCH] conf: Follow changes to the host nameserver used for DNS forwarding Date: Fri, 13 Nov 2026 16:51:31 +0530 Message-ID: <20261113112131.39181-1-adityamerchant08@gmail.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20261113010928.6872aca9@elisabeth> References: <20261113010928.6872aca9@elisabeth> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-MailFrom: adityamerchant08@gmail.com X-Mailman-Rule-Hits: nonmember-moderation X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation Message-ID-Hash: CL7QQOSIOXLEJLBFKSLSJHS3LM6ANCAE X-Message-ID-Hash: CL7QQOSIOXLEJLBFKSLSJHS3LM6ANCAE X-Mailman-Approved-At: Fri, 13 Nov 2026 14:07:19 +0100 CC: passt-dev@passt.top, David Gibson , Paul Holzinger X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Hi Stefano, On Fri, 13 Nov 2026 01:09:29 +0100 Stefano Brivio wrote: > Thanks for looking into this part. It looks like sysnet_watch_config() > is exactly what we need here, so I think we should add that on top of > the existing sysnet_read_config() rules. Note that I haven't tested > this (yet). I had a look: sysnet_watch_config() allows watches on net_conf_t files and links, but we watch the directory holding resolv.conf, and SELinux checks the inode being watched, so for /etc that's etc_t. In v2, which I just sent, I used files_watch_etc_dirs() instead, plus networkmanager_watch_pid_dirs() and systemd_resolved_watch_pid_dirs() for links into /run/NetworkManager and /run/systemd/resolve. It builds against Fedora 45's policy (for /etc, it adds "allow pasta_t etc_t:dir { getattr watch }"), but I couldn't try it with SELinux enforcing. > I think it *might* be worth it, but I'm not sure how complicated that > is, so I'm fine either way. If it's a few lines (20 or so?) I would > suggest giving it a try. It's under 20 lines: in a separate mount namespace, an overlay mounted on /etc lets the test replace resolv.conf. It's test/pasta_options/ dns_host_follow in v2, and it fails without the patch. > - just get rid of it and hardcode that, parsing only the directory part > in conf_resolv_watch()? Can we safely do that? Almost: if resolv.conf is a link, its target can have another name. But the usual one, systemd-resolved's stub-resolv.conf, always lists 127.0.0.53, so there's nothing to follow there. v2 hard-codes "resolv.conf", and doesn't follow anything else. > Couldn't this feature be useful for passt(1) as well, by the way? I think so, for guests using --dns-forward. But passt doesn't allow openat() in its seccomp filter, and I didn't want to add that without asking. Would you like it as a follow-up patch? > ...but we don't know if it's failing because of an older kernel, or > because of some other issue that we shouldn't ignore. And in any case, > it's probably not a good idea to introduce this mechanism in a less > secure way for kernel versions between 5.2 and 5.12: I'd rather goto > fail; here. Done. > For robustness, we should make sure that 'buf' is zero-terminated here, > see how passt-repair's wait_for_socket() handles this. > > True, pasta_netns_quit_inotify_handler() doesn't do that (and we should > fix that as well), but at least it uses strncmp(). Done, and patch 2/2 does the same in pasta_netns_quit_inotify_handler(). > Shouldn't we break here? Yes, done. > I'm wondering if we shouldn't include > instead. It's much broader but probably more compatible and also the > right thing to do. I haven't checked whether that works, though. I tried it: /etc/resolv.conf still works, but links into /run stop working, because files on the detached copy show up with paths relative to /run (AppArmor denied "/resolvconf/resolv.conf" and "/systemd/resolve/resolv.conf"), and nameservice only has the full paths. So I kept the explicit rule. Thanks a lot for the review! -- Aditya