From mboxrd@z Thu Jan 1 00:00:00 1970 From: Kirill Tkhai Subject: [PATCH] iptables: Per-net ns lock Date: Fri, 20 Apr 2018 16:42:47 +0300 Message-ID: <152423174378.4473.8708420767261754117.stgit@localhost.localdomain> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit To: fw@strlen.de, netdev@vger.kernel.org, pablo@netfilter.org, rstoyanov1@gmail.com, ptikhomirov@virtuozzo.com, avagin@virtuozzo.com, ktkhai@virtuozzo.com Return-path: Received: from mail-eopbgr30103.outbound.protection.outlook.com ([40.107.3.103]:26190 "EHLO EUR03-AM5-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1754830AbeDTNmy (ORCPT ); Fri, 20 Apr 2018 09:42:54 -0400 Sender: netdev-owner@vger.kernel.org List-ID: Containers want to restore their own net ns, while they may have no their own mnt ns. This case they share host's /run/xtables.lock file, but they may not have permission to open it. Patch makes /run/xtables.lock to be per-namespace, i.e., to refer to the caller task's net ns. Signed-off-by: Kirill Tkhai --- iptables/xshared.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/iptables/xshared.c b/iptables/xshared.c index 06db72d4..b6dbe4e7 100644 --- a/iptables/xshared.c +++ b/iptables/xshared.c @@ -254,7 +254,12 @@ static int xtables_lock(int wait, struct timeval *wait_interval) time_left.tv_sec = wait; time_left.tv_usec = 0; - fd = open(XT_LOCK_NAME, O_CREAT, 0600); + if (symlink("/proc/self/ns/net", XT_LOCK_NAME) != 0 && + errno != EEXIST) { + fprintf(stderr, "Fatal: can't create lock file\n"); + return XT_LOCK_FAILED; + } + fd = open(XT_LOCK_NAME, O_RDONLY); if (fd < 0) { fprintf(stderr, "Fatal: can't open lock file %s: %s\n", XT_LOCK_NAME, strerror(errno));