lsns: show namespaces only kept alive by open file descriptors#2902
Conversation
Signed-off-by: Masatake YAMATO <yamato@redhat.com>
Close util-linux#1884. Quoted from the original issue comment submitted by @hesch: It can happen, that a namespace is only kept alive by an open file descriptor of a program as ilustrated by A.B: 1. 'ip netns add foo' - add a namespace 2. 'sleep 999 4< /run/netns/foo & sleep 2' - open the fd to the namespace in a background job 3. 'ip netns delete foo' - delete the namespace (only deletes the /run/netns/foo) Now there exists a namespace with no process running in it and it has no bind mount so it does not show up in /proc/mounts, but it is still there and could be mounted back. Signed-off-by: Masatake YAMATO <yamato@redhat.com>
|
Seems not related to the change: |
|
A test case about the |
|
About the failure of lslocks, a "SLEEP" was already added. |
|
Hi. This makes |
There are more places in util-linux where user namespaces are expected. The optimal solution is to detect the missing feature and continue without it if possible. From this point of view, I'm not sure if, for example: if (stat("/proc/self/ns/user", &st) < 0)
err(EXIT_FAILURE, _("failed to do stat /proc/self/ns/user"));is an optimal solution, maybe it would be better not to use err() but return -1 (or so), etc. @masatake, what do you think? |
|
@karelzak I agree with you; calling err() is too much. The purpose of the function, including the line, is to get the st_dev of the device on which the "nsfs" file system is. Not only /proc/self/ns/user, but also the other dentries under /proc/self/ns, can be used as arguments for stat(2). Returning 0 or -1 is the last resort. I will make a pull request implementing the fallbacks. @axelkar, how can I quickly test lsns on a non-CONFIG_USER_NS kernel? |
You either have to somehow mask out Here is a guide on how to create a userspace: Though I'd do it with NixOS (refs: VM, easy kernel config modification) $ nix-build '<nixpkgs/nixos>' -A vm -I nixos-config=./configuration.nix
$ QEMU_KERNEL_PARAMS=console=ttyS0 ./result/bin/run-nixos-vm -nographic; reset# configuration.nix
{ pkgs, ... }:
{
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
users.users.root.initialPassword = "root";
boot.kernelPatches = [
{
name = "disable CONFIG_USER_NS";
patch = null;
extraConfig = ''
USER_NS n
'';
}
];
environment.systemPackages = [
(pkgs.util-linux.overrideAttrs (previousAttrs: {
patches = previousAttrs.patches ++ [
./0001-fix-lsns.patch
];
}))
# or
(pkgs.util-linux.overrideAttrs {
src = ./util-linux;
})
];
system.stateVersion = "25.05";
} |
…ries In 7d5036f ("lsns: show namespaces only kept alive by open file descriptors"), I added a code that calls stat(2) on /proc/self/ns/user and made lsns exit after reporting an error if the call failed. I assumed /proc/self/ns/user would be available on all platforms. As Axel Karjalainen reported (link below), that assumption was wrong: on some platforms the file is absent. Exiting for this reason is undesirable. The stat(2) call is used to obtain the dev_t of the backing device of nsfs. However, /proc/self/ns/user is not the only source; calling stat(2) on other namespace files under /proc/self/ns yields the same dev_t. This change iterates over entries under /proc/self/ns and uses the first one whose stat(2) succeeds. Reported-by: Axel Karjalainen <axel@axka.fi> Link: util-linux#2902 (comment) Fixes: 7d5036f ("lsns: show namespaces only kept alive by open file descriptors") Signed-off-by: Masatake YAMATO <yamato@redhat.com>
…ries In 7d5036f ("lsns: show namespaces only kept alive by open file descriptors"), I added code that calls stat(2) on /proc/self/ns/user and made lsns exit after reporting an error if the call failed. I assumed /proc/self/ns/user would be available on all platforms. As Axel Karjalainen reported (link below), that assumption was wrong: on some platforms, the file is absent. Exiting for this reason is undesirable. The stat(2) call is used to obtain the dev_t of the backing device of nsfs. However, /proc/self/ns/user is not the only source; calling stat(2) on other namespace files under /proc/self/ns yields the same dev_t. This change iterates over entries under /proc/self/ns and uses the first one whose stat(2) succeeds. Reported-by: Axel Karjalainen <axel@axka.fi> Link: util-linux#2902 (comment) Fixes: 7d5036f ("lsns: show namespaces only kept alive by open file descriptors") Signed-off-by: Masatake YAMATO <yamato@redhat.com>
Close #1884.
Even after removing the nsfs file created by ip-netns-add, lsns successfully reports the namespace.