From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=none (p=none dis=none) header.from=gibson.dropbear.id.au Authentication-Results: passt.top; dkim=pass (2048-bit key; secure) header.d=gibson.dropbear.id.au header.i=@gibson.dropbear.id.au header.a=rsa-sha256 header.s=202608 header.b=bjv4AEJ3; dkim-atps=neutral Received: from mail.ozlabs.org (gandalf.ozlabs.org [150.107.74.76]) by passt.top (Postfix) with ESMTPS id 860355A026E for ; Tue, 08 Sep 2026 08:24:17 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gibson.dropbear.id.au; s=202608; t=1788848645; bh=+Kl1Z7l+qHmki6e/+zfkp76ZfU87OSc19Kz0FIzucF8=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=bjv4AEJ3GMrRTaLO9NjlCYAXrLqVRSTd/vTmOb2jDHMMoQVu9OlisRXkbxCRJmYGG 9g+/AZd+OgDp+IakkFzgug0o38EhReC9NOfwUVKpEcAfN6UWx5F/OfZVOZCoF01T+V mHymddXwv1L1TEM1LVW4ETApHJrRjZOKbRI3ZW5mOb3rKC7fE7kJdDtEz95rMSCofm dLC1Ti621bpaOkpEqcFI0ZClTqF5hQEXh49JNn2I8A/BDReaCKQzweTYlEIc5YyFhL 28zE+3kmVXeP7REzWTvkk09pLONuOL3oXPRzgRURjsnguyLQ6KVMadlkZfkdanLGjf bLK0fCdGhhswA== Received: by gandalf.ozlabs.org (Postfix, from userid 1007) id 4hfDRT6Nfkz4wGB; Tue, 08 Sep 2026 16:24:05 +1000 (AEST) Date: Tue, 8 Sep 2026 16:24:04 +1000 From: David Gibson To: Stefano Brivio Subject: Re: [PATCH] RFC: Don't override system's default ping_group_range for pasta Message-ID: References: <20260820071748.1014070-1-david@gibson.dropbear.id.au> <20260906120526.67bc10d6@elisabeth> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="x6d3N000wCKSX6U7" Content-Disposition: inline In-Reply-To: <20260906120526.67bc10d6@elisabeth> Message-ID-Hash: WU37I2SRT3FXG534JGS5VXY5534FUOS4 X-Message-ID-Hash: WU37I2SRT3FXG534JGS5VXY5534FUOS4 X-MailFrom: dgibson@gandalf.ozlabs.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: passt-dev@passt.top, Laurent Vivier X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: --x6d3N000wCKSX6U7 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Sun, Sep 06, 2026 at 12:05:27PM +0200, Stefano Brivio wrote: > On Thu, 20 Aug 2026 17:17:48 +1000 > David Gibson wrote: >=20 > > When spawning a command, pasta sets the net.ipv4.ping_group_range sysctl > > to 0 0, meaning only group 0 can use ping sockets within the namespace. > > Since group 0 is the only one we map in the userns, that's equivalent to > > anyone being able to use ping sockets. > >=20 > > Although the kernel default for this is 1 0 (nobody can use ping socket= s), > > common distros - at least ones using systemd or even just systemd-udevd= - > > appear to set it to "0 2147483647" meaning effectively anyone can use > > ping sockets. >=20 > This wasn't the case on CirrOS (https://github.com/cirros-dev/cirros) > and on some more common distributions. For example Alpine sets it to > "999 59999", so group 0 is excluded. Ah, hm, right. > I haven't checked other distributions not running systemd, but I would > expect similar outcomes. >=20 > > There's no obvious reason that we need to override the system's default > > behaviour here. The override was introduced in 32d07f5e5 ("passt, past= a: > > Completely avoid dynamic memory allocation") as part of a large chunk w= hich > > kind of looks like it was meant to be in another patch, so the git hist= ory > > isn't particularly informative. >=20 > Kind of: the override was actually introduced by 089dec90ca99 ("pasta: > Set ping_group_range upon namespace creation"), which I dropped by mistake > (pasta.c not committed) in 675174d4ba25 ("conf, tap: Split netlink and > pasta functions, allow interface configuration"), and finally added back > by committing pasta.c in 32d07f5e59f2 ("passt, pasta: Completely avoid > dynamic memory allocation"). >=20 > It's not really informative anyway. But, in any case, unless this does > any harm, I'd rather keep the override, because ping might otherwise > break on a number of distributions. Doesn't really do any harm - that's why this is RFC. I had plans to move lots of the stuff in this function to various other places in order to facilitate dealing with the close_range() versus spawned process problem. But yeah, if a bunch of distros don't allow ping from group 0, that will break things. Although... currently we map UID 0 in the namespace to the calling user in the parent (like unshare -Ur). In some ways it would make more sense to identity map the parent UID (like unshare -Uc), but let the spawned process retain CAP_NET_ADMIN so it can still configure the network. We're operating basically in the parent filesystem, in which context we "feel" close to being the parent user than root, even though we have root-like privilege to control the pasta network. If we did so, that would fix the ping issue as a side effect - if we're in the ping group range as the parent UID (which pasta would need to forward pings anyway) then we should also be so in the namespace. > > Signed-off-by: David Gibson > > --- > > pasta.c | 3 --- > > 1 file changed, 3 deletions(-) > >=20 > > diff --git a/pasta.c b/pasta.c > > index 5aa56b78..4248b508 100644 > > --- a/pasta.c > > +++ b/pasta.c > > @@ -198,9 +198,6 @@ static int pasta_spawn_cmd(void *arg) > > if (mount("", "/proc", "proc", 0, NULL)) > > warn_perror("Couldn't mount /proc"); > > =20 > > - if (write_file("/proc/sys/net/ipv4/ping_group_range", "0 0")) > > - warn("Cannot set ping_group_range, ICMP requests might fail"); > > - > > a =3D (const struct pasta_spawn_cmd_arg *)arg; > > =20 > > conf_hostname_len =3D strlen(a->c->hostname); >=20 > --=20 > Stefano >=20 --=20 David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson --x6d3N000wCKSX6U7 Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEO+dNsU4E3yXUXRK2zQJF27ox2GcFAmqfqfQACgkQzQJF27ox 2GdH2A//QASeO9vKKbPPyRn9RKaZkNoVYFbsXer7b5Z/ToRmd2g1nrLg4WH/JTgm MvX1I0mGLnnRw9agy8M0qW6zwM5jNBGLMsFmmtf0syjdP8jItnU0fcYL6VH4eXZ3 0+qT2KgMdm7YyFemTUjlTYc17HOcczlDPw53tEDwSN9ZjH5Wd1bJzCBdZ2FznxKf nVTNZWER6WatFZP6D2efZK9KeAOTbAcTnuvIuIKw2Jtssgog3P1iR/ykk23JNtzI Zq2gb5td+X27/v2p9SQ8ydyCrrH6GDuJKbvTYfJ74zFP3WoYthzJF5vzvVveWTZZ +YB6EFV4ImfmCHtduxcjnAEIJa/hlSw/WyHcCKyubTEd0xRBLH6Z4rOdiYsyNvQj TKiTGF4zuUuRMshsE5aeasy6PNWDMZW4EhelSAxS5rAo9TMiIypIMGCFu7CCSD2g +Q4eWD/CWclazvgDXrtvXdyBtYitlLuIg173+x9d2GLitwiyZQz7ehD37epNLjWB SuyXU/9wzBKlnIcQ1jn2OVZHxZ6fi9rLtJYRvdKG07pde39zkQVYAxMmAvNAJzAf oAvL2kDIw+P1OrAQhdaRlJPD96y8Agg440EVSAV+xNBAKNPIMWm8akePU9A2JOdf v99Ni/ZUjWU7j1gbCyvtkexw0H907LSgiCThxDXQ1WdMfh+YdTQ= =PDHa -----END PGP SIGNATURE----- --x6d3N000wCKSX6U7--