Re: [PATCH] pasta: wait for netns setup before calling exec

[Paul Holzinger <pholzing@redhat.com>]

On 02/02/2023 11:25, Stefano Brivio wrote:
> On Wed,  1 Feb 2023 19:01:16 +0100
> Paul Holzinger <pholzing@redhat.com> wrote:
>
>> When a user spawns a command with pasta they expect the network to be
>> ready. Currently this does not work because pasta will fork/exec
>> before it will setup the network config.
>>
>> This patch fixes it by using a pipe to sync parent and child. The child
>> will now block reading from this pipe before the exec call. The parent
>> will then unblock the child only after the netns was configured.
> Thanks for the patch! I'm reviewing this in a bit.
>
> A few considerations meanwhile:
>
> - there's actually a bigger issue (you're fixing here) than the
>    namespace configuration (via netlink) itself: the tap device isn't
>    ready (tap_sock_init() hasn't been called yet) when we spawn the
>    command in the new namespace. Oops.
>
>    If you're wondering: we can't just reorder things, because to complete
>    the configuration phase (conf()) we need the namespace to be set up,
>    and we can't initialise the tap device before it's set up
>
> - pipes are more commonly used to transfer data around (hence the whole
>    code you need to open a communication channel, check it, close it).
>    Did you try with a signal? Or is there a reason why it wouldn't work?
>
>    You could simply SIGSTOP the child, from the child itself:
>
> 	kill(getpid(), SIGSTOP);
>
>    and send a SIGCONT to it (we already store the PID of the child in
>    pasta_child_pid) once we're ready.
>
>    SIGCONT is special in that it doesn't need CAP_KILL or the processes
>    to run under the same UID -- just in the same session, so it wouldn't
>    risk interfering with the isolation_*() calls.
>
>    I haven't tested this but I think it should lead to simpler code.
>
I simply haven't thought of using the stop signal, we use pipes like that
in podman so I knew how to implement it.
I will test your approach, I agree that it would be a bit simpler.