June 2023 - dev

[RFC v2] tcp: add support for read with offset when using MSG_PEEK
by Jon Maloy 05 Sep '23

05 Sep '23

When reading received messages with MSG_PEEK, we sometines have to read the leading bytes of the stream several times, only to reach the bytes we really want. This is clearly non-optimal. What we would want is something similar to pread/preadv(), but working even for tcp sockets. At the same time, we obviously don't want to add any new arguments to the recv/recvmsg() calls. In this commit, we allow the user to set iovec.iov_base in the first vector entry to NULL. This tells the socket to skip the first entry, hence making the iov_len field of that entry indicate the offset value. This way, there is no need to add any new arguments. This change is simple and non-intrusive, and should be safe addition to the socket API. We have measured it to give a throughput improvement of 8-10 % for the protocol splicer 'passst', which is used in KubeVirt containers. Signed-off-by: Jon Maloy <jmaloy(a)redhat.com> works with original msghdr Signed-off-by: Jon Maloy <jmaloy(a)redhat.com> --- net/ipv4/tcp.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c index 33f559f491c8..1d89337e89b6 100644 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@ -2428,6 +2428,7 @@ static int tcp_recvmsg_locked(struct sock *sk, struct msghdr *msg, size_t len, struct tcp_sock *tp = tcp_sk(sk); int copied = 0; u32 peek_seq; + u32 peek_offset; u32 *seq; unsigned long used; int err; @@ -2435,7 +2436,6 @@ static int tcp_recvmsg_locked(struct sock *sk, struct msghdr *msg, size_t len, long timeo; struct sk_buff *skb, *last; u32 urg_hole = 0; - err = -ENOTCONN; if (sk->sk_state == TCP_LISTEN) goto out; @@ -2469,6 +2469,14 @@ static int tcp_recvmsg_locked(struct sock *sk, struct msghdr *msg, size_t len, if (flags & MSG_PEEK) { peek_seq = tp->copied_seq; seq = &peek_seq; + if (msg->msg_iter.iov[0].iov_base == NULL) { + peek_offset = msg->msg_iter.iov[0].iov_len; + msg->msg_iter.iov = &msg->msg_iter.iov[1]; + msg->msg_iter.nr_segs -= 1; + msg->msg_iter.count -= peek_offset; + len -= peek_offset; + *seq += peek_offset; + } } target = sock_rcvlowat(sk, flags & MSG_WAITALL, len); -- 2.39.0

3 5

[PATCH 00/27] RFC: Start converting passt & pasta tests to Avocado using special plugin
by David Gibson 10 Jul '23

10 Jul '23

I've sent previous series converting some of the passt & pasta testsuite to use Avocado. However the jUnit-like structure of avocado tests wasn't a great fit for our needs (plus Stefano and I just dislike the style). Here's another attempt, where instead we use a new "avocado-classless" plugin to avoid jUnit-ism. This is definitely a work-in-progress. Some early observations: * It is noticeably less verbose than jUnit style * It does avoid some of the confusing stuff that arises from jUnit style * The present draft has some different pretty confusing stuff, involving nested and stacked function decorators, and some other non-entirely-obvious use of higher order functions * I hope I can improve this at least a bit, but it will need some thought * I was pleasantly surprised at how simple it was to write the plugin itself David Gibson (27): avocado: Make a duplicate copy of testsuite for comparison purposes avocado: Don't double download assets for test/ and oldtest/ avocado: Move static checkers to avocado avocado: Introduce "avocado-classless" plugin, runner and outline avocado, test: Add static checkers for Python code avocado: Resolver implementation for avocado-classless plugin avocado: Add basic assertion helpers to avocado-classless plugin tasst, avocado: Introduce library of common test helpers avocado-classless: Test matrices by composition tasst: Helper functions for executing commands in different places avocado-classless: Allow overriding default timeout avocado: Convert build tests to avocado tasst: Add helpers for running background commands on sites tasst: Add helper to get network interface names for a site tasst: Add helpers to run commands with nstool tasst: Add ifup and network address helpers to Site tasst: Helper for creating veth devices between namespaces tasst: Add helper for getting MTU of a network interface tasst: Add helper to wait for IP address to appear tasst: Add helpers for getting a site's routes tasst: Helpers to test transferring data between sites tasst: IP address allocation helpers tasst: Helpers for running daemons with a pidfile tasst: Helpers for testing NDP behaviour tasst: Helpers for testing DHCP & DHCPv6 behaviour tasst: Helpers to construct a simple network environment for tests avocado: Convert basic pasta tests Makefile | 9 + oldtest/.gitignore | 11 + oldtest/Makefile | 119 +++ oldtest/README.md | 137 +++ {test => oldtest}/build/all | 0 {test => oldtest}/build/clang_tidy | 0 {test => oldtest}/build/cppcheck | 0 oldtest/ci | 1 + oldtest/demo/passt | 245 ++++++ oldtest/demo/pasta | 274 ++++++ oldtest/demo/podman | 819 ++++++++++++++++++ oldtest/distro/debian | 252 ++++++ oldtest/distro/fedora | 396 +++++++++ oldtest/distro/opensuse | 208 +++++ oldtest/distro/ubuntu | 216 +++++ oldtest/env/mate-terminal.profile | 42 + oldtest/find-arm64-firmware.sh | 13 + oldtest/lib/context | 130 +++ oldtest/lib/layout | 259 ++++++ oldtest/lib/layout_ugly | 113 +++ oldtest/lib/perf_report | 272 ++++++ oldtest/lib/setup | 385 ++++++++ oldtest/lib/setup_ugly | 58 ++ oldtest/lib/term | 750 ++++++++++++++++ oldtest/lib/test | 398 +++++++++ oldtest/lib/util | 133 +++ oldtest/lib/video | 152 ++++ oldtest/memory/passt | 187 ++++ oldtest/nstool.c | 565 ++++++++++++ oldtest/passt.mbuto | 83 ++ oldtest/passt.mem.mbuto | 44 + oldtest/passt/dhcp | 70 ++ oldtest/passt/ndp | 33 + oldtest/passt/shutdown | 19 + oldtest/passt/tcp | 76 ++ oldtest/passt/udp | 46 + oldtest/passt_in_ns/icmp | 32 + oldtest/passt_in_ns/shutdown | 19 + oldtest/passt_in_ns/tcp | 256 ++++++ oldtest/passt_in_ns/udp | 138 +++ {test => oldtest}/pasta/dhcp | 0 {test => oldtest}/pasta/ndp | 0 {test => oldtest}/pasta/tcp | 0 {test => oldtest}/pasta/udp | 0 oldtest/pasta_options/log_to_file | 93 ++ oldtest/perf/passt_tcp | 215 +++++ oldtest/perf/passt_udp | 165 ++++ oldtest/perf/pasta_tcp | 300 +++++++ oldtest/perf/pasta_udp | 219 +++++ oldtest/prepare-distro-img.sh | 18 + oldtest/run | 238 +++++ oldtest/run_demo | 1 + oldtest/two_guests/basic | 80 ++ oldtest/valgrind.supp | 9 + test/.gitignore | 2 + test/Makefile | 69 +- test/avocado/build.py | 94 ++ test/avocado/pasta.py | 129 +++ test/avocado/static_checkers/clang-tidy.sh | 3 + test/avocado/static_checkers/cppcheck.sh | 3 + test/avocado/static_checkers/flake8.sh | 3 + test/avocado/static_checkers/pylint.sh | 3 + test/avocado_classless/.gitignore | 1 + .../avocado_classless/__init__.py | 11 + .../avocado_classless/manifest.py | 48 + .../avocado_classless/plugin.py | 231 +++++ .../avocado_classless/test.py | 80 ++ test/avocado_classless/examples.py | 57 ++ test/avocado_classless/selftests.py | 76 ++ test/avocado_classless/setup.py | 32 + test/lib/layout | 31 - test/lib/setup | 47 - test/run | 14 - test/tasst/__init__.py | 11 + test/tasst/address.py | 80 ++ test/tasst/dhcp.py | 114 +++ test/tasst/dhcpv6.py | 74 ++ test/tasst/exesite.py | 285 ++++++ test/tasst/meta/__init__.py | 16 + test/tasst/meta/static_ifup.py | 60 ++ test/tasst/meta/veth.py | 86 ++ test/tasst/ndp.py | 99 +++ test/tasst/nstool.py | 184 ++++ test/tasst/pasta.py | 42 + test/tasst/scenario/__init__.py | 12 + test/tasst/scenario/simple.py | 98 +++ test/tasst/transfer.py | 174 ++++ test/tasst/typecheck.py | 47 + 88 files changed, 10518 insertions(+), 96 deletions(-) create mode 100644 oldtest/.gitignore create mode 100644 oldtest/Makefile create mode 100644 oldtest/README.md rename {test => oldtest}/build/all (100%) rename {test => oldtest}/build/clang_tidy (100%) rename {test => oldtest}/build/cppcheck (100%) create mode 120000 oldtest/ci create mode 100644 oldtest/demo/passt create mode 100644 oldtest/demo/pasta create mode 100644 oldtest/demo/podman create mode 100644 oldtest/distro/debian create mode 100644 oldtest/distro/fedora create mode 100644 oldtest/distro/opensuse create mode 100644 oldtest/distro/ubuntu create mode 100644 oldtest/env/mate-terminal.profile create mode 100755 oldtest/find-arm64-firmware.sh create mode 100644 oldtest/lib/context create mode 100644 oldtest/lib/layout create mode 100644 oldtest/lib/layout_ugly create mode 100755 oldtest/lib/perf_report create mode 100755 oldtest/lib/setup create mode 100755 oldtest/lib/setup_ugly create mode 100755 oldtest/lib/term create mode 100755 oldtest/lib/test create mode 100755 oldtest/lib/util create mode 100755 oldtest/lib/video create mode 100644 oldtest/memory/passt create mode 100644 oldtest/nstool.c create mode 100755 oldtest/passt.mbuto create mode 100755 oldtest/passt.mem.mbuto create mode 100644 oldtest/passt/dhcp create mode 100644 oldtest/passt/ndp create mode 100644 oldtest/passt/shutdown create mode 100644 oldtest/passt/tcp create mode 100644 oldtest/passt/udp create mode 100644 oldtest/passt_in_ns/icmp create mode 100644 oldtest/passt_in_ns/shutdown create mode 100644 oldtest/passt_in_ns/tcp create mode 100644 oldtest/passt_in_ns/udp rename {test => oldtest}/pasta/dhcp (100%) rename {test => oldtest}/pasta/ndp (100%) rename {test => oldtest}/pasta/tcp (100%) rename {test => oldtest}/pasta/udp (100%) create mode 100644 oldtest/pasta_options/log_to_file create mode 100644 oldtest/perf/passt_tcp create mode 100644 oldtest/perf/passt_udp create mode 100644 oldtest/perf/pasta_tcp create mode 100644 oldtest/perf/pasta_udp create mode 100755 oldtest/prepare-distro-img.sh create mode 100755 oldtest/run create mode 120000 oldtest/run_demo create mode 100644 oldtest/two_guests/basic create mode 100644 oldtest/valgrind.supp create mode 100644 test/avocado/build.py create mode 100644 test/avocado/pasta.py create mode 100755 test/avocado/static_checkers/clang-tidy.sh create mode 100755 test/avocado/static_checkers/cppcheck.sh create mode 100755 test/avocado/static_checkers/flake8.sh create mode 100755 test/avocado/static_checkers/pylint.sh create mode 100644 test/avocado_classless/.gitignore create mode 100644 test/avocado_classless/avocado_classless/__init__.py create mode 100644 test/avocado_classless/avocado_classless/manifest.py create mode 100644 test/avocado_classless/avocado_classless/plugin.py create mode 100644 test/avocado_classless/avocado_classless/test.py create mode 100644 test/avocado_classless/examples.py create mode 100644 test/avocado_classless/selftests.py create mode 100644 test/avocado_classless/setup.py create mode 100644 test/tasst/__init__.py create mode 100644 test/tasst/address.py create mode 100644 test/tasst/dhcp.py create mode 100644 test/tasst/dhcpv6.py create mode 100644 test/tasst/exesite.py create mode 100644 test/tasst/meta/__init__.py create mode 100644 test/tasst/meta/static_ifup.py create mode 100644 test/tasst/meta/veth.py create mode 100644 test/tasst/ndp.py create mode 100644 test/tasst/nstool.py create mode 100644 test/tasst/pasta.py create mode 100644 test/tasst/scenario/__init__.py create mode 100644 test/tasst/scenario/simple.py create mode 100644 test/tasst/transfer.py create mode 100644 test/tasst/typecheck.py -- 2.41.0

2 31

[PATCH] MAKE: Fix parallel builds; .o files; .gitignore; new makedocs
by KuhnChris 02 Jul '23

02 Jul '23

From: KuhnChris <kuhnchris(a)kuhnchris.eu> --- .gitignore | 1 + Makefile | 51 +++++++++++++++++++++++++-------------------------- makedocs.pl | 19 +++++++++++++++++++ 3 files changed, 45 insertions(+), 26 deletions(-) create mode 100644 makedocs.pl diff --git a/.gitignore b/.gitignore index d3d0e2c..caeafa5 100644 --- a/.gitignore +++ b/.gitignore @@ -1,4 +1,5 @@ *~ +*.o /passt /passt.avx2 /pasta diff --git a/Makefile b/Makefile index a5256f5..4c99771 100644 --- a/Makefile +++ b/Makefile @@ -100,29 +100,41 @@ else BIN := passt pasta qrap endif -all: $(BIN) $(MANPAGES) docs +.NOTPARALLEL: seccomp.h +all: seccomp.h $(BIN) $(MANPAGES) docs + +PASST_OBJS = $(PASST_SRCS:.c=.o) +PASST_AVX2_OBJS = $(PASST_SRCS:.c=.avx2.o) +OBJS = $(SRCS:.c=.o) +QRAP_OBJS = $(QRAP_SRCS:.c=.o) +AVXFLAGS += -Ofast -mavx2 -ftree-vectorize -funroll-loops static: FLAGS += -static -DGLIBC_NO_STATIC_NSS -static: clean all +static: clean seccomp.h all seccomp.h: seccomp.sh $(PASST_SRCS) $(PASST_HEADERS) @ EXTRA_SYSCALLS="$(EXTRA_SYSCALLS)" ARCH="$(TARGET_ARCH)" CC="$(CC)" ./seccomp.sh $(PASST_SRCS) $(PASST_HEADERS) -passt: $(PASST_SRCS) $(HEADERS) - $(CC) $(FLAGS) $(CFLAGS) $(CPPFLAGS) $(PASST_SRCS) -o passt $(LDFLAGS) +.c.o: + $(CC) $(FLAGS) $(CFLAGS) $(CPPFLAGS) -c $< -o $@ + +$(PASST_AVX2_OBJS): seccomp.h + $(CC) $(AVXFLAGS) $(FLAGS) $(CFLAGS) $(CPPFLAGS) -c $(@:.avx2.o=.c) -o $@ + +passt: $(PASST_OBJS) seccomp.h + $(CC) $(FLAGS) $(CFLAGS) $(CPPFLAGS) $(PASST_OBJS) -o passt $(LDFLAGS) -passt.avx2: FLAGS += -Ofast -mavx2 -ftree-vectorize -funroll-loops -passt.avx2: $(PASST_SRCS) $(HEADERS) - $(CC) $(filter-out -O2,$(FLAGS)) $(CFLAGS) $(CPPFLAGS) \ - $(PASST_SRCS) -o passt.avx2 $(LDFLAGS) +passt.avx2: $(PASST_AVX2_OBJS) $(HEADERS) seccomp.h + $(CC) $(filter-out -O2,$(FLAGS)) $(CFLAGS) $(CPPFLAGS) $(AVXFLAGS) \ + $(PASST_AVX2_OBJS) -o passt.avx2 $(LDFLAGS) -passt.avx2: passt +passt.avx2: passt seccomp.h pasta.avx2 pasta.1 pasta: pasta%: passt% ln -sf $< $@ -qrap: $(QRAP_SRCS) passt.h - $(CC) $(FLAGS) $(CFLAGS) $(CPPFLAGS) $(QRAP_SRCS) -o qrap $(LDFLAGS) +qrap: $(QRAP_OBJS) passt.h seccomp.h + $(CC) $(FLAGS) $(CFLAGS) $(CPPFLAGS) $(QRAP_OBJS) -o qrap $(LDFLAGS) valgrind: EXTRA_SYSCALLS += rt_sigprocmask rt_sigtimedwait rt_sigaction \ getpid gettid kill clock_gettime mmap \ @@ -170,21 +182,8 @@ pkgs: static # other way around: the web version should be obtained by adding HTML and # JavaScript portions to a plain Markdown, instead. However, cgit needs to use # a file in the git tree. Find a better way around this. -docs: README.md - @( \ - skip=0; \ - while read l; do \ - case $$l in \ - "## Demo") exit 0 ;; \ - "<!"*) ;; \ - "</"*) skip=1 ;; \ - "<"*) skip=2 ;; \ - esac; \ - \ - [ $$skip -eq 0 ] && echo "$$l"; \ - [ $$skip -eq 1 ] && skip=0; \ - done < README.md; \ - ) > README.plain.md +docs: + [ ! -e doc/ ]; mkdir docs; perl makedocs.pl > docs/README.plain.md # Checkers currently disabled for clang-tidy: # - llvmlibc-restrict-system-libc-headers diff --git a/makedocs.pl b/makedocs.pl new file mode 100644 index 0000000..295e1d9 --- /dev/null +++ b/makedocs.pl @@ -0,0 +1,19 @@ +use strict; + +my $str = ''; +my $regex = qr/(<[^\/].*?>.*?<\/.*?>\n?)|(<\/div>)|(<\/p>)/msp; +my $subst = ''; + + +local $/=undef; +open FILE, '<', 'README.md' or die "Can't open file $!"; +my $file_content = <FILE>; +close FILE; +#print "Source: $file_content\n"; +my $result = $file_content =~ s/$regex//rg; + +my $regex2 = qr/\n[ \n]{3,}\n/msp; +$result = $result =~ s/$regex2/\n\n/rg; + +#print "The result of the substitution is: $result\n"; +print "$result\n"; -- 2.30.2

3 2

[PATCH 0/2] Fix bugs in validation of interface names
by David Gibson 28 Jun '23

28 Jun '23

We have a number of off by one bugs when checking the lengths of networking interface names. David Gibson (2): conf: Fix size checking of -I interface name conf: Correct length checking of interface names in conf_ports() conf.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) -- 2.41.0

2 3

passt: new version 2023_06_27.289301b available
by Stefano Brivio 27 Jun '23

27 Jun '23

The new version with tag 2023_06_27.289301b includes the following change: 289301b netlink: Use correct interface index in NL_SET mode https://passt.top/passt/log/?qt=range&q=2023_06_25.32660ce..2023_06_27.2893… Packages: - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Debian tracker: https://tracker.debian.org/pkg/passt - Copr (CentOS Stream, EPEL, Fedora, Mageia, openSUSE): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/6119154/ permanent mirror: https://passt.top/builds/copr/0^20230627.g289301b/ - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Ubuntu tracker: https://packages.ubuntu.com/lunar/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g289301b-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_289301b-1_all.deb -- Stefano

1 0

[PATCH] netlink: Use correct interface index in NL_SET mode
by David Gibson 27 Jun '23

27 Jun '23

nl_addr() and nl_route() take an 'op' selector which affects a number of parameters to the netlink call. Unfortunately when we introduced this option a bug was introduced so that we always use the interface index for the host side, rather than the one for the pasta namespace. Really, the entire interface to nl_addr() and nl_route() is pretty bad: it's tightly coupled with the use cases of its callers. This is a minimal fix which doesn't address that, but also doesn't make it significantly worse. Bugzilla: https://bugs.passt.top/show_bug.cgi?id=59 Fixes: 2fe046185634 ("netlink: Add functionality to copy routes from outer namespace") Fixes: e89da3cf03b2 ("netlink: Add functionality to copy addresses from outer namespace") Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- netlink.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/netlink.c b/netlink.c index bc5b2bf9..e15e23f9 100644 --- a/netlink.c +++ b/netlink.c @@ -226,7 +226,7 @@ void nl_route(enum nl_op op, unsigned int ifi, unsigned int ifi_ns, .rta.rta_type = RTA_OIF, .rta.rta_len = RTA_LENGTH(sizeof(unsigned int)), - .ifi = ifi, + .ifi = op == NL_SET ? ifi_ns : ifi, }; unsigned dup_routes = 0; ssize_t n, nlmsgs_size; @@ -370,7 +370,7 @@ void nl_addr(enum nl_op op, unsigned int ifi, unsigned int ifi_ns, .nlh.nlmsg_seq = nl_seq++, .ifa.ifa_family = af, - .ifa.ifa_index = ifi, + .ifa.ifa_index = op == NL_SET ? ifi_ns : ifi, .ifa.ifa_prefixlen = op == NL_SET ? *prefix_len : 0, }; ssize_t n, nlmsgs_size; -- 2.41.0

2 1

passt: new version 2023_06_25.32660ce available
by Stefano Brivio 26 Jun '23

26 Jun '23

The new version with tag 2023_06_25.32660ce includes the following changes: 32660ce pasta: include errno in error message 594dce6 isolation: keep CAP_SYS_PTRACE when required 5b646b9 conf: Accept -a and -g without --config-net in pasta mode d034fb6 conf: Make -a/--address really imply --no-copy-addrs db29fd2 seccomp: Make seccomp.sh re-entrancy safe 3c6d1b9 conf, log: On -h / --help, print usage to stdout, not stderr d072ac2 tap: With pasta, don't reset on tap errors, handle write failures https://passt.top/passt/log/?qt=range&q=2023_06_03.429e1a7..2023_06_25.3266… Packages: - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Debian tracker: https://tracker.debian.org/pkg/passt - Copr (CentOS Stream, EPEL, Fedora, Mageia, openSUSE): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/6113117/ permanent mirror: https://passt.top/builds/copr/0^20230625.g32660ce/ - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Ubuntu tracker: https://packages.ubuntu.com/lunar/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g32660ce-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_32660ce-1_all.deb -- Stefano

1 0

[PATCH] isolation: keep CAP_SYS_PTRACE when required
by Paul Holzinger 26 Jun '23

26 Jun '23

When pasta is started from an existing userns and tries to join the netns from another process it fails to open /proc/$pid/ns/net due the missing CAP_SYS_PTRACE capability in the --netns-only case. A simple reproducer for this. First create a userns: $ unshare -r Then create a new netns inside it and try to join that netns with pasta. $ unshare -n sleep inf & $ pasta --config-net --netns /proc/$!/ns/net Signed-off-by: Paul Holzinger <pholzing(a)redhat.com> --- isolation.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/isolation.c b/isolation.c index 19932bf..1866724 100644 --- a/isolation.c +++ b/isolation.c @@ -202,9 +202,11 @@ void isolate_initial(void) * a mapping from UID 0, which only happens with pasta spawning a child * from a non-init user namespace (pasta can't run as root), we need to * retain CAP_SETFCAP too. + * We also need to keep CAP_SYS_PTRACE in order to join an existing netns + * path under /proc/$pid/ns/net which was created in the same userns. */ if (!ns_is_init() && !geteuid()) - keep |= BIT(CAP_SETFCAP); + keep |= BIT(CAP_SETFCAP) | BIT(CAP_SYS_PTRACE); drop_caps_ep_except(keep); } -- 2.41.0

2 1

[PATCH] pasta: include errno in error message
by Paul Holzinger 26 Jun '23

26 Jun '23

When the open() or setns() calls fails pasta exits early and prints an error. However it did not include the errno so it was impossible to know why the syscall failed. Signed-off-by: Paul Holzinger <pholzing(a)redhat.com> --- pasta.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pasta.c b/pasta.c index 13ab18b..27809d2 100644 --- a/pasta.c +++ b/pasta.c @@ -136,14 +136,14 @@ void pasta_open_ns(struct ctx *c, const char *netns) nfd = open(netns, O_RDONLY | O_CLOEXEC); if (nfd < 0) - die("Couldn't open network namespace %s", netns); + die("Couldn't open network namespace %s: %s", netns, strerror(errno)); c->pasta_netns_fd = nfd; NS_CALL(ns_check, c); if (c->pasta_netns_fd < 0) - die("Couldn't switch to pasta namespaces"); + die("Couldn't switch to pasta namespaces: %s", strerror(errno)); if (!c->no_netns_quit) { char buf[PATH_MAX] = { 0 }; @@ -261,7 +261,7 @@ void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid, NS_CALL(pasta_wait_for_ns, c); if (c->pasta_netns_fd < 0) - die("Failed to join network namespace"); + die("Failed to join network namespace: %s", strerror(errno)); } /** -- 2.41.0

3 2

[PATCH] seccomp: Make seccomp.sh re-entrancy safe
by David Gibson 26 Jun '23

26 Jun '23

seccomp.sh generates seccomp.h piece by piece using >> directives. This means that if two instances of seccomp.h are run concurrently a corrupted version of seccomp.h will be generated. Amongst other problems this can cause spurious failures on clang-tidy. Alter seccomp.sh to build the output in a temporary file and atomic move it to seccomp.h, so concurrent invocations will still result in valud output. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- seccomp.sh | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/seccomp.sh b/seccomp.sh index 092c24e0..e1224e0d 100755 --- a/seccomp.sh +++ b/seccomp.sh @@ -15,7 +15,7 @@ TMP="$(mktemp)" IN="$@" -OUT="seccomp.h" +OUT="$(mktemp)" [ -z "${ARCH}" ] && ARCH="$(uname -m)" [ -z "${CC}" ] && CC="cc" @@ -53,7 +53,7 @@ BST=' BPF_JUMP(BPF_JMP | BPF_JGE | BPF_K, @NR@, @R@, @L@),' # cleanup() - Remove temporary file if it exists cleanup() { - rm -f "${TMP}" + rm -f "${TMP}" "${OUT}" } trap "cleanup" EXIT @@ -254,3 +254,5 @@ for __p in ${__profiles}; do gen_profile "${__p}" ${__calls} done + +mv "${OUT}" seccomp.h -- 2.41.0

2 2