From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=none (p=none dis=none) header.from=gibson.dropbear.id.au Authentication-Results: passt.top; dkim=pass (2048-bit key; secure) header.d=gibson.dropbear.id.au header.i=@gibson.dropbear.id.au header.a=rsa-sha256 header.s=202608 header.b=mwqAjN8/; dkim-atps=neutral Received: from mail.ozlabs.org (gandalf.ozlabs.org [150.107.74.76]) by passt.top (Postfix) with ESMTPS id 8AC8E5A0269 for ; Wed, 09 Sep 2026 08:09:51 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gibson.dropbear.id.au; s=202608; t=1788934179; bh=j1MQHiJG3C22Ai4r8HIiVZf+rp6pKGgfC7peMzmYBHg=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=mwqAjN8/sNGawEnN78E96MLaRg+pdyI0F18Tbg23EGRdPIX2WpacPbsuPXXzHy/wk 4hLei0NaF7RUtIyJhKCrtM33T+f8H3nJ6U5vlF73k8WJ5T2oO/NU+rKpBLs1zfS7LX 55WFBv6ZPpu8snKBhhBvZNv1A8q7Y0/aYcNhSmdCZe+AlGjuAKBTg1sBv8mcbAZJW/ 8uph6Z5wb2ktBaQN5JoBPBzEUNkdGzLJGa7PuyyB7+c0zpyMr5rsWvIdy5WUgIBxyM 0vnx1bMF/M9jT0THAeygdIfVZ0AEav8HaGiXs6Psnb8ZAXa3UbPfoNTntHP171ZKge 5Uh8p7iucirGw== Received: by gandalf.ozlabs.org (Postfix, from userid 1007) id 4hfr4M38KSz4wCM; Wed, 09 Sep 2026 16:09:39 +1000 (AEST) Date: Wed, 9 Sep 2026 16:09:43 +1000 From: David Gibson To: Stefano Brivio Subject: Re: [PATCH] RFC: Don't override system's default ping_group_range for pasta Message-ID: References: <20260820071748.1014070-1-david@gibson.dropbear.id.au> <20260906120526.67bc10d6@elisabeth> <20260908173237.46db8656@elisabeth> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="U46OIKuazWPX/b5k" Content-Disposition: inline In-Reply-To: <20260908173237.46db8656@elisabeth> Message-ID-Hash: 5A5EZKRD4PAGHQSCG7NKYJ74OLVX33YB X-Message-ID-Hash: 5A5EZKRD4PAGHQSCG7NKYJ74OLVX33YB X-MailFrom: dgibson@gandalf.ozlabs.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: passt-dev@passt.top, Laurent Vivier X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: --U46OIKuazWPX/b5k Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Tue, Sep 08, 2026 at 05:32:37PM +0200, Stefano Brivio wrote: > On Tue, 8 Sep 2026 16:24:04 +1000 > David Gibson wrote: >=20 > > On Sun, Sep 06, 2026 at 12:05:27PM +0200, Stefano Brivio wrote: > > > On Thu, 20 Aug 2026 17:17:48 +1000 > > > David Gibson wrote: > > > =20 > > > > When spawning a command, pasta sets the net.ipv4.ping_group_range s= ysctl > > > > to 0 0, meaning only group 0 can use ping sockets within the namesp= ace. > > > > Since group 0 is the only one we map in the userns, that's equivale= nt to > > > > anyone being able to use ping sockets. > > > >=20 > > > > Although the kernel default for this is 1 0 (nobody can use ping so= ckets), > > > > common distros - at least ones using systemd or even just systemd-u= devd - > > > > appear to set it to "0 2147483647" meaning effectively anyone can u= se > > > > ping sockets. =20 > > >=20 > > > This wasn't the case on CirrOS (https://github.com/cirros-dev/cirros) > > > and on some more common distributions. For example Alpine sets it to > > > "999 59999", so group 0 is excluded. =20 > >=20 > > Ah, hm, right. > >=20 > > > I haven't checked other distributions not running systemd, but I would > > > expect similar outcomes. > > > =20 > > > > There's no obvious reason that we need to override the system's def= ault > > > > behaviour here. The override was introduced in 32d07f5e5 ("passt, = pasta: > > > > Completely avoid dynamic memory allocation") as part of a large chu= nk which > > > > kind of looks like it was meant to be in another patch, so the git = history > > > > isn't particularly informative. =20 > > >=20 > > > Kind of: the override was actually introduced by 089dec90ca99 ("pasta: > > > Set ping_group_range upon namespace creation"), which I dropped by mi= stake > > > (pasta.c not committed) in 675174d4ba25 ("conf, tap: Split netlink and > > > pasta functions, allow interface configuration"), and finally added b= ack > > > by committing pasta.c in 32d07f5e59f2 ("passt, pasta: Completely avoid > > > dynamic memory allocation"). > > >=20 > > > It's not really informative anyway. But, in any case, unless this does > > > any harm, I'd rather keep the override, because ping might otherwise > > > break on a number of distributions. =20 > >=20 > > Doesn't really do any harm - that's why this is RFC. I had plans to > > move lots of the stuff in this function to various other places in > > order to facilitate dealing with the close_range() versus spawned > > process problem. > >=20 > > But yeah, if a bunch of distros don't allow ping from group 0, that > > will break things. > >=20 > > Although... currently we map UID 0 in the namespace to the calling > > user in the parent (like unshare -Ur). In some ways it would make > > more sense to identity map the parent UID (like unshare -Uc), but let > > the spawned process retain CAP_NET_ADMIN so it can still configure the > > network. We're operating basically in the parent filesystem, in which > > context we "feel" close to being the parent user than root, even > > though we have root-like privilege to control the pasta network. > >=20 > > If we did so, that would fix the ping issue as a side effect - if > > we're in the ping group range as the parent UID (which pasta would > > need to forward pings anyway) then we should also be so in the > > namespace. >=20 > ...maybe, yeah. It doesn't really feel like a priority to me though. No, it's not. Maybe I'll implement it if the spirit moves me, since I'm not really beholden to practical priorities at the moment. --=20 David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson --U46OIKuazWPX/b5k Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEO+dNsU4E3yXUXRK2zQJF27ox2GcFAmqg+BoACgkQzQJF27ox 2GciOQ/7BFtEkdZzN/48U71EJ2W9BApRZHqukn46jDZMDIwTIMAGpJ+JfrNtrkAz qtuCWdKGxcctlYKArk/UUO872U7FaT4tPJB2odwNFhEV2SD2WEtmzrYJ3eTSn9NK zST/jcu2fB2HpFw3N2AVGADtMhLPpgj+gjx50ExWE1zfdU5I0sIvw2+yK86B52Wp K6skOFSu9EPZO98byHSAlgB54HFS4TIsGgcxz/Y7DWBhJ8hOhj4eaDAr3XPdKI1f j0+SNGbSCzMTsKGBE2v/wB7MSCPdlKaGcW69XR9KGtgOEWqg5BTSbqEli6LVNGLR IHtlhAtXfLcoxd6i40xF4FJ0Rs8Qr4UP6+vYXIFRDaJsbJ25tXPV011nsFILjTd0 KGHQ8evPZBIOW7HR64yksiIj+oyHKDRxuKSkG2PtW1npZvUpPwGII7YOMf/TICwe UcDMK7zCxU6xz2B64iRh6BMWueUEUbJ1pG/zrHQt+aE8+ORTybnVKun1ssCdcJ0W W5SWpe02TTYRGAiNFzkmLENf3+3jaYx198Rj2CwcYONehICP01lrlnn1NfuSM5Rj QwwGMkIn6/viFo+9IYv9QUv3+PUez/BRCCEhY/ExPVKWSDbxTpQKUsJyFC1OWidQ f9FLq9ixSfuTcrpzcSAPb9S8KnD2II/7MVTIxhhifTYXjMZ2iE8= =4ARh -----END PGP SIGNATURE----- --U46OIKuazWPX/b5k--