* [PATCH] iptables: Per-net ns lock @ 2018-04-20 13:42 Kirill Tkhai 2018-04-20 23:06 ` Andrei Vagin 0 siblings, 1 reply; 3+ messages in thread From: Kirill Tkhai @ 2018-04-20 13:42 UTC (permalink / raw) To: fw, netdev, pablo, rstoyanov1, ptikhomirov, avagin, ktkhai Containers want to restore their own net ns, while they may have no their own mnt ns. This case they share host's /run/xtables.lock file, but they may not have permission to open it. Patch makes /run/xtables.lock to be per-namespace, i.e., to refer to the caller task's net ns. Signed-off-by: Kirill Tkhai <ktkhai@virtuozzo.com> --- iptables/xshared.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/iptables/xshared.c b/iptables/xshared.c index 06db72d4..b6dbe4e7 100644 --- a/iptables/xshared.c +++ b/iptables/xshared.c @@ -254,7 +254,12 @@ static int xtables_lock(int wait, struct timeval *wait_interval) time_left.tv_sec = wait; time_left.tv_usec = 0; - fd = open(XT_LOCK_NAME, O_CREAT, 0600); + if (symlink("/proc/self/ns/net", XT_LOCK_NAME) != 0 && + errno != EEXIST) { + fprintf(stderr, "Fatal: can't create lock file\n"); + return XT_LOCK_FAILED; + } + fd = open(XT_LOCK_NAME, O_RDONLY); if (fd < 0) { fprintf(stderr, "Fatal: can't open lock file %s: %s\n", XT_LOCK_NAME, strerror(errno)); ^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] iptables: Per-net ns lock 2018-04-20 13:42 [PATCH] iptables: Per-net ns lock Kirill Tkhai @ 2018-04-20 23:06 ` Andrei Vagin 2018-04-23 9:03 ` Kirill Tkhai 0 siblings, 1 reply; 3+ messages in thread From: Andrei Vagin @ 2018-04-20 23:06 UTC (permalink / raw) To: Kirill Tkhai; +Cc: fw, netdev, pablo, rstoyanov1, ptikhomirov On Fri, Apr 20, 2018 at 04:42:47PM +0300, Kirill Tkhai wrote: > Containers want to restore their own net ns, > while they may have no their own mnt ns. > This case they share host's /run/xtables.lock > file, but they may not have permission to open > it. > > Patch makes /run/xtables.lock to be per-namespace, > i.e., to refer to the caller task's net ns. > > Signed-off-by: Kirill Tkhai <ktkhai@virtuozzo.com> > --- > iptables/xshared.c | 7 ++++++- > 1 file changed, 6 insertions(+), 1 deletion(-) > > diff --git a/iptables/xshared.c b/iptables/xshared.c > index 06db72d4..b6dbe4e7 100644 > --- a/iptables/xshared.c > +++ b/iptables/xshared.c > @@ -254,7 +254,12 @@ static int xtables_lock(int wait, struct timeval *wait_interval) > time_left.tv_sec = wait; > time_left.tv_usec = 0; > > - fd = open(XT_LOCK_NAME, O_CREAT, 0600); > + if (symlink("/proc/self/ns/net", XT_LOCK_NAME) != 0 && Any user can open this file and take the lock. Before this patch, the lock file could be opened only by the root user. It means that any user will be able to block all iptables operations. Do I miss something? [root@fc24 ~]# ln -s /proc/self/ns/net /run/xtables.lock2 [root@fc24 ~]# ls -l /run/xtables.lock2 lrwxrwxrwx 1 root root 17 Apr 21 01:52 /run/xtables.lock2 -> /proc/self/ns/net [root@fc24 ~]# ls -l /proc/self/ns/net lrwxrwxrwx 1 root root 0 Apr 21 01:52 /proc/self/ns/net -> net:[4026531993] Thanks, Andrei > + errno != EEXIST) { > + fprintf(stderr, "Fatal: can't create lock file\n"); fprintf(stderr, "Fatal: can't create lock file %s: %s\n", XT_LOCK_NAME, strerror(errno)); > + return XT_LOCK_FAILED; > + } > + fd = open(XT_LOCK_NAME, O_RDONLY); > if (fd < 0) { > fprintf(stderr, "Fatal: can't open lock file %s: %s\n", > XT_LOCK_NAME, strerror(errno)); > ^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] iptables: Per-net ns lock 2018-04-20 23:06 ` Andrei Vagin @ 2018-04-23 9:03 ` Kirill Tkhai 0 siblings, 0 replies; 3+ messages in thread From: Kirill Tkhai @ 2018-04-23 9:03 UTC (permalink / raw) To: Andrei Vagin; +Cc: fw, netdev, pablo, rstoyanov1, ptikhomirov On 21.04.2018 02:06, Andrei Vagin wrote: > On Fri, Apr 20, 2018 at 04:42:47PM +0300, Kirill Tkhai wrote: >> Containers want to restore their own net ns, >> while they may have no their own mnt ns. >> This case they share host's /run/xtables.lock >> file, but they may not have permission to open >> it. >> >> Patch makes /run/xtables.lock to be per-namespace, >> i.e., to refer to the caller task's net ns. >> >> Signed-off-by: Kirill Tkhai <ktkhai@virtuozzo.com> >> --- >> iptables/xshared.c | 7 ++++++- >> 1 file changed, 6 insertions(+), 1 deletion(-) >> >> diff --git a/iptables/xshared.c b/iptables/xshared.c >> index 06db72d4..b6dbe4e7 100644 >> --- a/iptables/xshared.c >> +++ b/iptables/xshared.c >> @@ -254,7 +254,12 @@ static int xtables_lock(int wait, struct timeval *wait_interval) >> time_left.tv_sec = wait; >> time_left.tv_usec = 0; >> >> - fd = open(XT_LOCK_NAME, O_CREAT, 0600); >> + if (symlink("/proc/self/ns/net", XT_LOCK_NAME) != 0 && > > Any user can open this file and take the lock. Before this patch, the > lock file could be opened only by the root user. It means that any user > will be able to block all iptables operations. Do I miss something? Yes, this is the idea. It looks like the only way to save compatibility with old iptables and to allow to set rules from nested net namespaces. Also, this allows to synchronize with containers, which have its own mount namespace. Comparing to existing interfaces in kernel, there is an example. Ordinary user can open a file RO on a partition, and this prevents root from umounting it But this is never considered as a problem, and nobody makes partitions available only for root in 0600 mode to prevent this. There is lsof, and it's easy to find the lock owner. The same with iptables. The lock is not a critical protection, it's just a try for different users to synchronize between each other. Real protection happens in setsockopt() path. > [root@fc24 ~]# ln -s /proc/self/ns/net /run/xtables.lock2 > [root@fc24 ~]# ls -l /run/xtables.lock2 > lrwxrwxrwx 1 root root 17 Apr 21 01:52 /run/xtables.lock2 -> > /proc/self/ns/net > [root@fc24 ~]# ls -l /proc/self/ns/net > lrwxrwxrwx 1 root root 0 Apr 21 01:52 /proc/self/ns/net -> > net:[4026531993] > > Thanks, > Andrei > >> + errno != EEXIST) { >> + fprintf(stderr, "Fatal: can't create lock file\n"); > > fprintf(stderr, "Fatal: can't create lock file %s: %s\n", > XT_LOCK_NAME, strerror(errno)); > >> + return XT_LOCK_FAILED; >> + } >> + fd = open(XT_LOCK_NAME, O_RDONLY); >> if (fd < 0) { >> fprintf(stderr, "Fatal: can't open lock file %s: %s\n", >> XT_LOCK_NAME, strerror(errno)); Kirill ^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2018-04-23 9:03 UTC | newest] Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2018-04-20 13:42 [PATCH] iptables: Per-net ns lock Kirill Tkhai 2018-04-20 23:06 ` Andrei Vagin 2018-04-23 9:03 ` Kirill Tkhai
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.