* [PATCH] iptables: accept lock file name at runtime
@ 2020-07-14 16:52 Giuseppe Scrivano
2020-07-14 23:27 ` Phil Sutter
0 siblings, 1 reply; 3+ messages in thread
From: Giuseppe Scrivano @ 2020-07-14 16:52 UTC (permalink / raw)
To: netfilter-devel; +Cc: gscrivan, Florian Westphal
allow users to override at runtime the lock file to use through the
XTABLES_LOCKFILE environment variable.
It allows using iptables from a network namespace owned by an user
that has no write access to XT_LOCK_NAME (by default under /run), and
without setting up a new mount namespace.
$ XTABLES_LOCKFILE=/tmp/xtables unshare -rn iptables ...
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
---
iptables/xshared.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/iptables/xshared.c b/iptables/xshared.c
index c1d1371a..291f1c4b 100644
--- a/iptables/xshared.c
+++ b/iptables/xshared.c
@@ -248,13 +248,18 @@ void xs_init_match(struct xtables_match *match)
static int xtables_lock(int wait, struct timeval *wait_interval)
{
+ const *lock_file;
struct timeval time_left, wait_time;
int fd, i = 0;
time_left.tv_sec = wait;
time_left.tv_usec = 0;
- fd = open(XT_LOCK_NAME, O_CREAT, 0600);
+ lock_file = getenv("XTABLES_LOCKFILE");
+ if (lock_file == NULL || lock_file[0] == '\0')
+ lock_file = XT_LOCK_NAME;
+
+ fd = open(lock_file, O_CREAT, 0600);
if (fd < 0) {
fprintf(stderr, "Fatal: can't open lock file %s: %s\n",
XT_LOCK_NAME, strerror(errno));
--
2.26.2
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] iptables: accept lock file name at runtime
2020-07-14 16:52 [PATCH] iptables: accept lock file name at runtime Giuseppe Scrivano
@ 2020-07-14 23:27 ` Phil Sutter
2020-07-15 6:19 ` Giuseppe Scrivano
0 siblings, 1 reply; 3+ messages in thread
From: Phil Sutter @ 2020-07-14 23:27 UTC (permalink / raw)
To: Giuseppe Scrivano; +Cc: netfilter-devel, Florian Westphal
Hi,
On Tue, Jul 14, 2020 at 06:52:06PM +0200, Giuseppe Scrivano wrote:
> allow users to override at runtime the lock file to use through the
> XTABLES_LOCKFILE environment variable.
>
> It allows using iptables from a network namespace owned by an user
> that has no write access to XT_LOCK_NAME (by default under /run), and
> without setting up a new mount namespace.
>
> $ XTABLES_LOCKFILE=/tmp/xtables unshare -rn iptables ...
>
> Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
> ---
> iptables/xshared.c | 7 ++++++-
> 1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/iptables/xshared.c b/iptables/xshared.c
> index c1d1371a..291f1c4b 100644
> --- a/iptables/xshared.c
> +++ b/iptables/xshared.c
> @@ -248,13 +248,18 @@ void xs_init_match(struct xtables_match *match)
>
> static int xtables_lock(int wait, struct timeval *wait_interval)
> {
> + const *lock_file;
This does not look right. Typo?
Cheers, Phil
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] iptables: accept lock file name at runtime
2020-07-14 23:27 ` Phil Sutter
@ 2020-07-15 6:19 ` Giuseppe Scrivano
0 siblings, 0 replies; 3+ messages in thread
From: Giuseppe Scrivano @ 2020-07-15 6:19 UTC (permalink / raw)
To: Phil Sutter; +Cc: netfilter-devel, Florian Westphal
Phil Sutter <phil@nwl.cc> writes:
> Hi,
>
> On Tue, Jul 14, 2020 at 06:52:06PM +0200, Giuseppe Scrivano wrote:
>> allow users to override at runtime the lock file to use through the
>> XTABLES_LOCKFILE environment variable.
>>
>> It allows using iptables from a network namespace owned by an user
>> that has no write access to XT_LOCK_NAME (by default under /run), and
>> without setting up a new mount namespace.
>>
>> $ XTABLES_LOCKFILE=/tmp/xtables unshare -rn iptables ...
>>
>> Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
>> ---
>> iptables/xshared.c | 7 ++++++-
>> 1 file changed, 6 insertions(+), 1 deletion(-)
>>
>> diff --git a/iptables/xshared.c b/iptables/xshared.c
>> index c1d1371a..291f1c4b 100644
>> --- a/iptables/xshared.c
>> +++ b/iptables/xshared.c
>> @@ -248,13 +248,18 @@ void xs_init_match(struct xtables_match *match)
>>
>> static int xtables_lock(int wait, struct timeval *wait_interval)
>> {
>> + const *lock_file;
>
> This does not look right. Typo?
yes sorry, I've messed it up. I'll send a v2.
Thanks,
Giuseppe
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2020-07-15 6:19 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-07-14 16:52 [PATCH] iptables: accept lock file name at runtime Giuseppe Scrivano
2020-07-14 23:27 ` Phil Sutter
2020-07-15 6:19 ` Giuseppe Scrivano
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).