Hello,

as an unprivileged us= er one is able to keep network namespaces from expiring by opening /proc/&l= t;pid>/net/dev of other processes. I've previously put this on stack= exchange [1] and then bugzilla [2]. That's been a while though, so post= ing here for a bit more visibility in case it's something that's wo= rth fixing.

The reproducer is roughly as follows. = As root:

# echo "100" > /proc/sys/user/max_net_n= amespaces

# while true ; do (unshare -n bash -c 'sleep 0.= 3 && readlink /proc/self/ns/net') || sleep 0.5 =C2=A0; done

As unprivileged user in a second terminal, run the be= low Python script [3]:

# python3 pin_net_namespaces.py

<= div>

After about one minute the first terminal will show the = following until the Python process keeping the network namespaces alive is = terminated.

...
unshare: unshare failed: No space left on = device
unshare: unshare failed: No space left on device

Without the change to max_net_namespaces reproducing just very lon= g, but then also kernel memory grows fairly large.

Does that seem like problematic behavior? I had attached a patch and= tests to [2], but I fall into the kernel newbie category, so not sure how = useful.

Thanks,

=C2=A0=C2=A0 Arne

[1] https://unix.stackexchange.com/questions/= 576718/opening-proc-pid-net-dev-prevents-network-namespace-from-expiring-is= -this-ex/

[2] https://bugzilla.kernel.org/show_bug.cgi?id=3D207351<= /div>

[3] $ cat pin_net_namespaces.py

#!/usr/bin/env python3
import glob
import os
import ti= me

net_namespaces =3D {}

while True:
=C2=A0 =C2=A0 for net= _dev in glob.glob("/proc/*/net/dev"):
=C2=A0 =C2=A0 =C2=A0 =C2= =A0 try:
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ino =3D os.stat(net_d= ev).st_ino
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 if ino not in net_n= amespaces:
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 net_n= amespaces[ino] =3D open(net_dev)
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 print("Have", len(net_namespaces), "namesp= aces...")
=C2=A0 =C2=A0 =C2=A0 =C2=A0 except FileNotFoundError:
= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 # not fast enough...
=C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 pass

=C2=A0 =C2=A0 time.sleep(0.2= )

=3D=3D=3D

--000000000000abfbd905ad7db8b2-- --===============7934087539902274228== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Kernelnewbies mailing list Kernelnewbies@kernelnewbies.org https://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies --===============7934087539902274228==--