Re: [PATCH 06/14] nstool: Detect what namespaces target is in

[David Gibson <david@gibson.dropbear.id.au>]

[-- Attachment #1: Type: text/plain, Size: 3248 bytes --]

On Wed, Apr 05, 2023 at 01:58:25PM +0200, Stefano Brivio wrote:
> On Tue,  4 Apr 2023 11:46:30 +1000
> David Gibson <david@gibson.dropbear.id.au> wrote:
> 
> > Give nstool the ability to detect what namespaces the target process is in,
> > relative to where it's called.  That is, those namespace types for which
> > the target is not in the same namespace as the caller.  For now, just
> > print this information with "info", which can be useful for debugging.
> > 
> > Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
> > ---
> >  test/nstool.c | 154 +++++++++++++++++++++++++++++++++++++++++++++-----
> >  1 file changed, 140 insertions(+), 14 deletions(-)
> > 
> > diff --git a/test/nstool.c b/test/nstool.c
> > index 2cb4fb3..428c9c4 100644
> > --- a/test/nstool.c
> > +++ b/test/nstool.c
> > @@ -15,8 +15,13 @@
> >  #include <errno.h>
> >  #include <unistd.h>
> >  #include <getopt.h>
> > +#include <stdarg.h>
> >  #include <sys/socket.h>
> >  #include <linux/un.h>
> > +#include <linux/limits.h>
> > +#include <sched.h>
> > +
> > +#define	ARRAY_SIZE(a)	((int)(sizeof(a) / sizeof((a)[0])))
> >  
> >  #define die(...)				\
> >  	do {					\
> > @@ -24,6 +29,28 @@
> >  		exit(1);			\
> >  	} while (0)
> >  
> > +struct ns_type {
> > +	int flag;
> > +	const char *name;
> > +};
> > +
> > +const struct ns_type nstypes[] = {
> > +	{ CLONE_NEWCGROUP, "cgroup" },
> > +	{ CLONE_NEWIPC, "ipc" },
> > +	{ CLONE_NEWNET, "net" },
> > +	{ CLONE_NEWNS, "mnt" },
> > +	{ CLONE_NEWPID, "pid" },
> > +	{ CLONE_NEWTIME, "time" },
> > +	{ CLONE_NEWUSER, "user" },
> > +	{ CLONE_NEWUTS, "uts" },
> > +};
> > +
> > +struct holder_info {
> > +	pid_t pid;
> > +	uid_t uid;
> > +	gid_t gid;
> > +};
> > +
> >  static void usage(void)
> >  {
> >  	die("Usage:\n"
> > @@ -41,12 +68,16 @@ static void usage(void)
> >  	    "    terminate.\n");
> >  }
> >  
> > -static int connect_ctl(const char * sockpath, bool wait)
> > +static int connect_ctl(const char *sockpath, bool wait,
> > +		       struct holder_info *info,
> > +		       struct ucred *peercred)
> >  {
> >  	int fd = socket(AF_UNIX, SOCK_STREAM, PF_UNIX);
> >  	struct sockaddr_un addr = {
> >  		.sun_family = AF_UNIX,
> >  	};
> > +	struct holder_info discard;
> > +	ssize_t len;
> >  	int rc;
> >  
> >  	if (fd < 0)
> > @@ -61,6 +92,25 @@ static int connect_ctl(const char * sockpath, bool wait)
> >  			die("connect() to %s: %s\n", sockpath, strerror(errno));
> >  	} while (rc < 0);
> >  
> > +	if (!info)
> > +		info = &discard;
> 
> As you close the socket anyway moments later, I wonder if it wouldn't
> be doable (and more natural) to just do:
> 
> 	if (info) {
> 		len = read(fd, info, sizeof(*info));
> 		...
> 	}

I had something like that initially, but that causes the holder to
spit a broken pipe error, which is distracting.

> 	if (peercred) {
> 		...
> 	}
> 
> ...but maybe it adds unnecessary complication to 7/14 (or perhaps the
> magic is not really part of 'info'?).
> 

-- 
David Gibson			| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au	| minimalist, thank you.  NOT _the_ _other_
				| _way_ _around_!
http://www.ozlabs.org/~dgibson

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]