From f099afb1f2f0a15eb0209a9893a5a23455939e71 Mon Sep 17 00:00:00 2001 From: Stefano Brivio Date: Sun, 14 May 2023 13:32:41 +0200 Subject: pasta: Improve error handling on failure to join network namespace In pasta_wait_for_ns(), open() failing with ENOENT is expected: we're busy-looping until the network namespace appears. But any other failure is not something we're going to recover from: return right away if we don't get either success or ENOENT. Now that pasta_wait_for_ns() can actually fail, handle that in pasta_start_ns() by reporting the issue and exiting. Looping on EPERM, when pasta doesn't actually have the permissions to join a given namespace, isn't exactly a productive thing to do. Signed-off-by: Stefano Brivio --- pasta.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) (limited to 'pasta.c') diff --git a/pasta.c b/pasta.c index b30ce70..1ebc868 100644 --- a/pasta.c +++ b/pasta.c @@ -95,10 +95,13 @@ static int pasta_wait_for_ns(void *arg) char ns[PATH_MAX]; snprintf(ns, PATH_MAX, "/proc/%i/ns/net", pasta_child_pid); - do - while ((c->pasta_netns_fd = open(ns, flags)) < 0); - while (setns(c->pasta_netns_fd, CLONE_NEWNET) && - !close(c->pasta_netns_fd)); + do { + while ((c->pasta_netns_fd = open(ns, flags)) < 0) { + if (errno != ENOENT) + return 0; + } + } while (setns(c->pasta_netns_fd, CLONE_NEWNET) && + !close(c->pasta_netns_fd)); return 0; } @@ -257,6 +260,8 @@ void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid, } NS_CALL(pasta_wait_for_ns, c); + if (c->pasta_netns_fd < 0) + die("Failed to join network namespace"); } /** -- cgit v1.2.3