diff options
| -rw-r--r-- | conf.c | 11 | ||||
| -rw-r--r-- | passt.1 | 12 | ||||
| -rw-r--r-- | passt.h | 2 | ||||
| -rw-r--r-- | pasta.c | 18 | ||||
| -rw-r--r-- | test/pasta_options/no_pidns | 25 | ||||
| -rwxr-xr-x | test/run | 1 |
6 files changed, 62 insertions, 7 deletions
@@ -742,6 +742,7 @@ pasta_opts: " implied if PATH or NAME are given without --userns\n" " --no-netns-quit Don't quit if filesystem-bound target\n" " network namespace is deleted\n" + " --no-pidns Don't spawn command in a new PID namespace\n" " --config-net Configure tap interface in namespace\n" " --no-copy-routes DEPRECATED:\n" " Don't copy all routes to namespace\n" @@ -1315,6 +1316,7 @@ void conf(struct ctx *c, int argc, char **argv) {"stats", required_argument, NULL, 31 }, {"conf-path", required_argument, NULL, 'c' }, {"chroot-fallback", no_argument, NULL, 32 }, + {"no-pidns", no_argument, NULL, 33 }, { 0 }, }; const char *optstring = "+dqfel:hs:c:F:I:p:P:m:a:n:M:g:i:o:D:S:H:461t:u:T:U:"; @@ -1559,6 +1561,12 @@ void conf(struct ctx *c, int argc, char **argv) case 32: c->chroot_fallback = true; break; + case 33: + if (c->mode != MODE_PASTA) + die("--no-pidns is for pasta mode only"); + + c->no_pidns = true; + break; case 'd': c->debug = 1; c->quiet = 0; @@ -1921,6 +1929,9 @@ void conf(struct ctx *c, int argc, char **argv) else if (optind != argc) die("Extra non-option argument: %s", argv[optind]); + if (c->no_pidns && *netns) + die("--no-pidns is incompatible with PID or --netns"); + conf_open_files(c); /* Before any possible setuid() / setgid() */ isolate_user(c, uid, gid, !netns_only, userns); @@ -705,6 +705,18 @@ network namespace is represented by a procfs entry, and that entry is deleted, representing the fact that a process with the given PID terminated. .TP +.BR \-\-no-pidns +Don't create a new PID namespace for the spawned command or shell: keep it in +the PID namespace \fBpasta\fR itself runs in, and don't mount a new +\fIprocfs\fR instance on \fI/proc\fR for it. This is useful in environments +where mounting \fIprocfs\fR is not permitted, such as containers, where the +command would otherwise get a \fI/proc\fR view that doesn't match its own PID +namespace. Note that, without a PID namespace, processes started by the +command are not terminated once the command exits. + +This option can't be specified with a PID or with \-\-netns. + +.TP .BR \-\-config-net Configure networking in the namespace: set up addresses and routes as configured or sourced from the host, and bring up the tap interface. @@ -195,6 +195,7 @@ struct ip6_ctx { * @pasta_ifn: Name of namespace interface for pasta * @pasta_ifi: Index of namespace interface for pasta * @pasta_conf_ns: Configure namespace after creating it + * @no_pidns: Don't create a new PID namespace for spawned command * @fwd: Forwarding tables * @fwd_pending: Pending forward tables * @no_tcp: Disable TCP operation @@ -278,6 +279,7 @@ struct ctx { char pasta_ifn[IF_NAMESIZE]; unsigned int pasta_ifi; int pasta_conf_ns; + bool no_pidns; struct fwd_table *fwd[PIF_NUM_TYPES]; struct fwd_table *fwd_pending[PIF_NUM_TYPES]; @@ -194,15 +194,17 @@ static int pasta_spawn_cmd(void *arg) if (prctl(PR_SET_PDEATHSIG, SIGKILL)) die_perror("Couldn't set PR_SET_PDEATHSIG"); - /* We run in a detached PID and mount namespace: mount /proc over */ - if (mount("", "/proc", "proc", 0, NULL)) + a = (const struct pasta_spawn_cmd_arg *)arg; + + /* We run in a detached mount namespace, and, unless --no-pidns was + * given, in a detached PID namespace: mount /proc over + */ + if (!a->c->no_pidns && mount("", "/proc", "proc", 0, NULL)) warn_perror("Couldn't mount /proc"); if (write_file("/proc/sys/net/ipv4/ping_group_range", "0 0")) warn("Cannot set ping_group_range, ICMP requests might fail"); - a = (const struct pasta_spawn_cmd_arg *)arg; - conf_hostname_len = strlen(a->c->hostname); if (conf_hostname_len > 0) { if (sethostname(a->c->hostname, conf_hostname_len)) @@ -239,6 +241,7 @@ static int pasta_spawn_cmd(void *arg) */ void pasta_start_ns(struct ctx *c, int argc, char *argv[]) { + int flags = CLONE_NEWIPC | CLONE_NEWNET | CLONE_NEWUTS | CLONE_NEWNS; char ns_fn_stack[NS_FN_STACK_SIZE] __attribute__ ((aligned(__alignof__(max_align_t)))); struct pasta_spawn_cmd_arg arg = { @@ -272,10 +275,11 @@ void pasta_start_ns(struct ctx *c, int argc, char *argv[]) sigaddset(&set, SIGUSR1); sigprocmask(SIG_BLOCK, &set, NULL); + if (!c->no_pidns) + flags |= CLONE_NEWPID; + pasta_child_pid = do_clone(pasta_spawn_cmd, ns_fn_stack, - sizeof(ns_fn_stack), - CLONE_NEWIPC | CLONE_NEWPID | CLONE_NEWNET | - CLONE_NEWUTS | CLONE_NEWNS | SIGCHLD, + sizeof(ns_fn_stack), flags | SIGCHLD, (void *)&arg); if (pasta_child_pid == -1) diff --git a/test/pasta_options/no_pidns b/test/pasta_options/no_pidns new file mode 100644 index 0000000..f565b2f --- /dev/null +++ b/test/pasta_options/no_pidns @@ -0,0 +1,25 @@ +# SPDX-License-Identifier: GPL-2.0-or-later +# +# PASST - Plug A Simple Socket Transport +# for qemu/UNIX domain socket mode +# +# PASTA - Pack A Subtle Tap Abstraction +# for network namespace/tap device mode +# +# test/pasta_options/no_pidns - Check --no-pidns handling + +htools readlink + +test Command is spawned in a new PID namespace by default +set PIDNS __STATEDIR__/pidns +set OUT __STATEDIR__/no-pidns.out +set ERR __STATEDIR__/no-pidns.err + +passt readlink /proc/self/ns/pid > __PIDNS__ +passt ./pasta -q -- readlink /proc/self/ns/pid > __OUT__ 2> __ERR__ +check [ "$(cat __PIDNS__)" != "$(cat __OUT__)" ] + +test --no-pidns keeps command in the caller's PID namespace +passt ./pasta -q --no-pidns -- readlink /proc/self/ns/pid > __OUT__ 2> __ERR__ +check [ "$(cat __PIDNS__)" = "$(cat __OUT__)" ] +check [ ! -s __ERR__ ] @@ -86,6 +86,7 @@ run() { setup pasta_options test pasta_options/log_to_file test pasta_options/netns_only + test pasta_options/no_pidns teardown pasta_options setup build |