- dev - passt

[PATCH 2/8] tcp, udp, fwd: Run all port scanning from a single timer
by David Gibson 11 Oct '25

11 Oct '25

With -t auto and similar options we need to periodically scan /proc for listening ports. Currently we do this separately for TCP and UDP, from tcp_timer() and udp_timer(). For upcoming changes (leading eventually to a more general forwarding table), it's awkward to have these separate. Move them to a single common timer. For now this just calls new tcp_scan_ports() and udp_scan_ports() functions, but we'll consolidate more thoroughly in later patches. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- fwd.c | 24 ++++++++++++++++++++++++ fwd.h | 3 +++ passt.c | 7 +++---- tcp.c | 33 ++++++++++++++++++++------------- tcp.h | 3 ++- udp.c | 29 ++++++++++++----------------- udp.h | 4 +--- 7 files changed, 65 insertions(+), 38 deletions(-) diff --git a/fwd.c b/fwd.c index 250cf564..bd89a94a 100644 --- a/fwd.c +++ b/fwd.c @@ -230,6 +230,30 @@ void fwd_scan_ports_init(struct ctx *c) } } +/* Last time we scanned for open ports */ +static struct timespec scan_ports_run; + +/** + * fwd_scan_ports_timer() - Rescan open port information when necessary + * @c: Execution context + * @now: Current (monotonic) time + */ +void fwd_scan_ports_timer(struct ctx *c, const struct timespec *now) +{ + if (c->mode != MODE_PASTA) + return; + + if (timespec_diff_ms(now, &scan_ports_run) < FWD_PORT_SCAN_INTERVAL) + return; + + scan_ports_run = *now; + + if (!c->no_tcp) + tcp_scan_ports(c); + if (!c->no_udp) + udp_scan_ports(c); +} + /** * is_dns_flow() - Determine if flow appears to be a DNS request * @proto: Protocol (IP L4 protocol number) diff --git a/fwd.h b/fwd.h index 65c7c964..385e5bd8 100644 --- a/fwd.h +++ b/fwd.h @@ -42,11 +42,14 @@ struct fwd_ports { in_port_t delta[NUM_PORTS]; }; +#define FWD_PORT_SCAN_INTERVAL 1000 /* ms */ + void fwd_scan_ports_tcp(struct fwd_ports *fwd, const struct fwd_ports *rev); void fwd_scan_ports_udp(struct fwd_ports *fwd, const struct fwd_ports *rev, const struct fwd_ports *tcp_fwd, const struct fwd_ports *tcp_rev); void fwd_scan_ports_init(struct ctx *c); +void fwd_scan_ports_timer(struct ctx *c, const struct timespec *now); bool nat_inbound(const struct ctx *c, const union inany_addr *addr, union inany_addr *translated); diff --git a/passt.c b/passt.c index b877659e..28ce5711 100644 --- a/passt.c +++ b/passt.c @@ -56,7 +56,7 @@ #define EPOLL_EVENTS 8 -#define TIMER_INTERVAL_ MIN(TCP_TIMER_INTERVAL, UDP_TIMER_INTERVAL) +#define TIMER_INTERVAL_ MIN(TCP_TIMER_INTERVAL, FWD_PORT_SCAN_INTERVAL) #define TIMER_INTERVAL MIN(TIMER_INTERVAL_, FLOW_TIMER_INTERVAL) char pkt_buf[PKT_BUF_BYTES] __attribute__ ((aligned(PAGE_SIZE))); @@ -117,11 +117,10 @@ static void post_handler(struct ctx *c, const struct timespec *now) /* NOLINTNEXTLINE(bugprone-branch-clone): intervals can be the same */ CALL_PROTO_HANDLER(tcp, TCP); - /* NOLINTNEXTLINE(bugprone-branch-clone): intervals can be the same */ - CALL_PROTO_HANDLER(udp, UDP); +#undef CALL_PROTO_HANDLER flow_defer_handler(c, now); -#undef CALL_PROTO_HANDLER + fwd_scan_ports_timer(c, now); if (!c->no_ndp) ndp_timer(c, now); diff --git a/tcp.c b/tcp.c index 0f9e9b3f..dbbb00c4 100644 --- a/tcp.c +++ b/tcp.c @@ -2869,25 +2869,32 @@ static int tcp_port_rebind_outbound(void *arg) } /** - * tcp_timer() - Periodic tasks: port detection, closed connections, pool refill + * tcp_scan_ports() - Update forwarding maps based on scan of listening ports * @c: Execution context - * @now: Current timestamp */ -void tcp_timer(struct ctx *c, const struct timespec *now) +void tcp_scan_ports(struct ctx *c) { - (void)now; + ASSERT(c->mode == MODE_PASTA && !c->no_tcp); - if (c->mode == MODE_PASTA) { - if (c->tcp.fwd_out.mode == FWD_AUTO) { - fwd_scan_ports_tcp(&c->tcp.fwd_out, &c->tcp.fwd_in); - NS_CALL(tcp_port_rebind_outbound, c); - } + if (c->tcp.fwd_out.mode == FWD_AUTO) { + fwd_scan_ports_tcp(&c->tcp.fwd_out, &c->tcp.fwd_in); + NS_CALL(tcp_port_rebind_outbound, c); + } - if (c->tcp.fwd_in.mode == FWD_AUTO) { - fwd_scan_ports_tcp(&c->tcp.fwd_in, &c->tcp.fwd_out); - tcp_port_rebind(c, false); - } + if (c->tcp.fwd_in.mode == FWD_AUTO) { + fwd_scan_ports_tcp(&c->tcp.fwd_in, &c->tcp.fwd_out); + tcp_port_rebind(c, false); } +} + +/** + * tcp_timer() - Periodic tasks: port detection, closed connections, pool refill + * @c: Execution context + * @now: Current timestamp + */ +void tcp_timer(const struct ctx *c, const struct timespec *now) +{ + (void)now; tcp_sock_refill_init(c); if (c->mode == MODE_PASTA) diff --git a/tcp.h b/tcp.h index 234a8033..43ab0655 100644 --- a/tcp.h +++ b/tcp.h @@ -21,7 +21,8 @@ int tcp_tap_handler(const struct ctx *c, uint8_t pif, sa_family_t af, int tcp_sock_init(const struct ctx *c, const union inany_addr *addr, const char *ifname, in_port_t port); int tcp_init(struct ctx *c); -void tcp_timer(struct ctx *c, const struct timespec *now); +void tcp_scan_ports(struct ctx *c); +void tcp_timer(const struct ctx *c, const struct timespec *now); void tcp_defer_handler(struct ctx *c); void tcp_update_l2_buf(const unsigned char *eth_d, const unsigned char *eth_s); diff --git a/udp.c b/udp.c index 86585b7e..d15f03dc 100644 --- a/udp.c +++ b/udp.c @@ -1239,28 +1239,23 @@ static int udp_port_rebind_outbound(void *arg) } /** - * udp_timer() - Scan activity bitmaps for ports with associated timed events + * udp_scan_ports() - Update forwarding maps based on scan of listening ports * @c: Execution context - * @now: Current timestamp */ -void udp_timer(struct ctx *c, const struct timespec *now) +void udp_scan_ports(struct ctx *c) { - (void)now; - - ASSERT(!c->no_udp); + ASSERT(c->mode == MODE_PASTA && !c->no_udp); - if (c->mode == MODE_PASTA) { - if (c->udp.fwd_out.mode == FWD_AUTO) { - fwd_scan_ports_udp(&c->udp.fwd_out, &c->udp.fwd_in, - &c->tcp.fwd_out, &c->tcp.fwd_in); - NS_CALL(udp_port_rebind_outbound, c); - } + if (c->udp.fwd_out.mode == FWD_AUTO) { + fwd_scan_ports_udp(&c->udp.fwd_out, &c->udp.fwd_in, + &c->tcp.fwd_out, &c->tcp.fwd_in); + NS_CALL(udp_port_rebind_outbound, c); + } - if (c->udp.fwd_in.mode == FWD_AUTO) { - fwd_scan_ports_udp(&c->udp.fwd_in, &c->udp.fwd_out, - &c->tcp.fwd_in, &c->tcp.fwd_out); - udp_port_rebind(c, false); - } + if (c->udp.fwd_in.mode == FWD_AUTO) { + fwd_scan_ports_udp(&c->udp.fwd_in, &c->udp.fwd_out, + &c->tcp.fwd_in, &c->tcp.fwd_out); + udp_port_rebind(c, false); } } diff --git a/udp.h b/udp.h index 8f8531ad..a6de1f1c 100644 --- a/udp.h +++ b/udp.h @@ -6,8 +6,6 @@ #ifndef UDP_H #define UDP_H -#define UDP_TIMER_INTERVAL 1000 /* ms */ - void udp_portmap_clear(void); void udp_listen_sock_handler(const struct ctx *c, union epoll_ref ref, uint32_t events, const struct timespec *now); @@ -20,7 +18,7 @@ int udp_tap_handler(const struct ctx *c, uint8_t pif, int udp_sock_init(const struct ctx *c, int ns, const union inany_addr *addr, const char *ifname, in_port_t port); int udp_init(struct ctx *c); -void udp_timer(struct ctx *c, const struct timespec *now); +void udp_scan_ports(struct ctx *c); void udp_update_l2_buf(const unsigned char *eth_d, const unsigned char *eth_s); /** -- 2.51.0

1 0

[PATCH v2 00/14] Clean up checksum and header generation for inbound packets
by David Gibson 10 Oct '25

10 Oct '25

The main packet "fast paths" for UDP and TCP mostly just forward packets rather than generating them from scratch. However the control paths for ICMP and DHCP sometimes generate packets more or less from scratch. Because these are relatively rare, it's not performance critical. The paths for sending these packets have some duplication of the header generation. There's also some layering violation in tap_ip_send() which both generates IP headers and updates the L4 (UDP or UCMP) checksum. Finally that checksum generation is a little awkward: it temporarily generates the IP pseudo header (or something close enough to serve) in the place of the actual header, generates the checksum, then replaces it with the real IP header. This approach seems to be causing miscompiles with some LTO optimization, because the stores to the pseudo header are being moved or elided across the code calculating the checksum. This series addresses all of these. We consolidate and clarify the packet sending helpers, and use them in some places there was previously duplicated code. In the process we use new checksum generation helpers which take a different approach which should avoid the LTO problems (this aspect I haven't tested yet though). Changes since v1: * Numerous minor style changes * Rename header generation helpers to make their behaviour clearer * Added several missing function doc comments * Corrected some erroneous statements and terms in comments David Gibson (14): Add csum_icmp6() helper for calculating ICMPv6 checksums Add csum_icmp4() helper for calculating ICMP checksums Add csum_udp6() helper for calculating UDP over IPv6 checksums Add csum_udp4() helper for calculating UDP over IPv4 checksums Add csum_ip4_header() helper to calculate IPv4 header checksums Add helpers for normal inbound packet destination addresses Remove support for TCP packets from tap_ip_send() tap: Remove unhelpeful vnet_pre optimization from tap_send() Split tap_ip_send() into IPv4 and IPv6 specific functions tap: Split tap_ip6_send() into UDP and ICMP variants ndp: Remove unneeded eh_source parameter ndp: Use tap_icmp6_send() helper tap: Split tap_ip4_send() into UDP and ICMP variants dhcp: Use tap_udp4_send() helper in dhcp() arp.c | 2 +- checksum.c | 120 ++++++++++++++++----- checksum.h | 15 ++- dhcp.c | 19 +--- dhcpv6.c | 21 +--- icmp.c | 12 +-- ndp.c | 28 +---- ndp.h | 3 +- tap.c | 312 ++++++++++++++++++++++++++++++++++------------------- tap.h | 19 +++- 10 files changed, 345 insertions(+), 206 deletions(-) -- 2.37.3

2 17

[PATCH] passt: Rename EPOLL_EVENTS to PASST_EPOLL_EVENTS
by Laurent Vivier 10 Oct '25

10 Oct '25

The macro EPOLL_EVENTS conflicts with enum EPOLL_EVENTS defined in sys/epoll.h (glibc). Rename the local macro to PASST_EPOLL_EVENTS to avoid this namespace collision. Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> --- passt.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/passt.c b/passt.c index 31fbb75b1b12..8307e0057360 100644 --- a/passt.c +++ b/passt.c @@ -54,7 +54,7 @@ #include "migrate.h" #include "repair.h" -#define EPOLL_EVENTS 8 +#define PASST_EPOLL_EVENTS 8 #define TIMER_INTERVAL__ MIN(TCP_TIMER_INTERVAL, UDP_TIMER_INTERVAL) #define TIMER_INTERVAL_ MIN(TIMER_INTERVAL__, ICMP_TIMER_INTERVAL) @@ -245,7 +245,7 @@ static void print_stats(const struct ctx *c, const struct passt_stats *stats, */ int main(int argc, char **argv) { - struct epoll_event events[EPOLL_EVENTS]; + struct epoll_event events[PASST_EPOLL_EVENTS]; struct passt_stats stats = { 0 }; int nfds, i, devnull_fd = -1; struct ctx c = { 0 }; @@ -349,7 +349,7 @@ int main(int argc, char **argv) loop: /* NOLINTBEGIN(bugprone-branch-clone): intervals can be the same */ /* cppcheck-suppress [duplicateValueTernary, unmatchedSuppression] */ - nfds = epoll_wait(c.epollfd, events, EPOLL_EVENTS, TIMER_INTERVAL); + nfds = epoll_wait(c.epollfd, events, PASST_EPOLL_EVENTS, TIMER_INTERVAL); /* NOLINTEND(bugprone-branch-clone) */ if (nfds == -1 && errno != EINTR) die_perror("epoll_wait() failed in main loop"); -- 2.50.1

2 2

[PATCH v2 3/3] test: For missing static checkers, skip rather than failing tests
by David Gibson 10 Oct '25

10 Oct '25

We run a bunch of static checkers as part of our testsuite. That's useful, but it means that if a user doesn't have one of them installed, it fails the entire testsuite. Alter our scripts to skip the test, rather than failing outright if the checker tool is not installed. This requires exeter v0.4.4 or later. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- test/build/static_checkers.sh | 24 ++++++++++++++++++------ test/lib/exeter | 10 +++++++++- 2 files changed, 27 insertions(+), 7 deletions(-) diff --git a/test/build/static_checkers.sh b/test/build/static_checkers.sh index 228b99ae..96679fb2 100755 --- a/test/build/static_checkers.sh +++ b/test/build/static_checkers.sh @@ -13,18 +13,30 @@ # Copyright Red Hat # Author: David Gibson <david(a)gibson.dropbear.id.au> -. $(dirname $0)/../exeter/sh/exeter.sh +. $(dirname ${0})/../exeter/sh/exeter.sh -exeter_register cppcheck make -C .. cppcheck +# do_check() - Run static checker as a test if the binary is available +# $1: Static checker (uased as both executable name and make target) +# $@: Any additional arguments required to make +do_check() { + checker="${1}" + shift + if ! which "${checker}" >/dev/null 2>/dev/null; then + exeter_skip "${checker} not available" + fi + make "${@}" "${checker}" +} + +exeter_register cppcheck do_check cppcheck -C .. exeter_set_description cppcheck "passt sources pass cppcheck" -exeter_register clang_tidy make -C .. clang-tidy +exeter_register clang_tidy do_check clang-tidy -C .. exeter_set_description clang_tidy "passt sources pass clang-tidy" -exeter_register flake8 make flake8 +exeter_register flake8 do_check flake8 exeter_set_description flake8 "passt tests in Python pass flake8" -exeter_register mypy make mypy +exeter_register mypy do_check mypy exeter_set_description mypy "passt tests in Python pass mypy --strict" -exeter_main "$@" +exeter_main "${@}" diff --git a/test/lib/exeter b/test/lib/exeter index 7ea084a4..ccdb19c2 100644 --- a/test/lib/exeter +++ b/test/lib/exeter @@ -49,7 +49,15 @@ exeter() { for __testid in $(${EXETOOL} list -- "${@}"); do __desc="$(${EXETOOL} desc -- "${@}" -- "${__testid}")" status_test_start "${__desc}" - context_run host "${*} '${__testid}'" && status_test_ok || status_test_fail + status=0 + context_run host "${*} '${__testid}'" || status="${?}" + if [ "${status}" = 0 ]; then + status_test_ok + elif [ "${status}" = 77 ]; then + status_test_skip + else + status_test_fail + fi done cd .. -- 2.51.0

1 0

[PATCH v2 2/3] test: Add some missing quoting in exeter runner
by David Gibson 10 Oct '25

10 Oct '25

exeter() quoted ${__testid}, but in some places we use it there's an extra level of shell, which needs another layer of quoting. This breaks if testids include ';', which is quite common in exeter tests created as a composition/pipeline of two functions. Add the required extra quoting. While we're there, improve consistency with other scripts by always using the optional {} around variable names. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- test/lib/exeter | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/test/lib/exeter b/test/lib/exeter index 0b361599..7ea084a4 100644 --- a/test/lib/exeter +++ b/test/lib/exeter @@ -47,9 +47,9 @@ exeter() { [ ${CI} -eq 1 ] && video_link "${1}" for __testid in $(${EXETOOL} list -- "${@}"); do - __desc="$(${EXETOOL} desc -- "${@}" -- ${__testid})" + __desc="$(${EXETOOL} desc -- "${@}" -- "${__testid}")" status_test_start "${__desc}" - context_run host "${@}" "${__testid}" && status_test_ok || status_test_fail + context_run host "${*} '${__testid}'" && status_test_ok || status_test_fail done cd .. -- 2.51.0

1 0

[PATCH v2 1/3] test: Use ${} consistently in lib/exeter
by David Gibson 10 Oct '25

10 Oct '25

Most of the test shell scripts use {} around variable names even when it's not required, for consistency. lib/exeter didn't do so consistently, however. Correct that. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- test/lib/exeter | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/test/lib/exeter b/test/lib/exeter index 3b19beaa..0b361599 100644 --- a/test/lib/exeter +++ b/test/lib/exeter @@ -13,18 +13,18 @@ # Copyright Red Hat # Author: David Gibson <david(a)gibson.dropbear.id.au> -EXETOOL="$BASEPATH/exeter/exetool/exetool" +EXETOOL="${BASEPATH}/exeter/exetool/exetool" # is_exeter() - Determine if a test file is an exeter program # $@: Command line to invoke test program is_exeter() { - $EXETOOL probe -- "$@" + ${EXETOOL} probe -- "${@}" } # exeter() - Run each test in an exeter program, logging each test separately # $@: Command line to invoke exeter test program exeter() { - STATESETUP="${STATEBASE}/$1" + STATESETUP="${STATEBASE}/${1}" mkdir -p "${STATESETUP}" context_setup_host host @@ -32,9 +32,9 @@ exeter() { cd test - __ntests=$($EXETOOL list -- "$@" | wc -l) - if [ $? != 0 ]; then - info "Failed to get exeter manifest for $@" + __ntests=$(${EXETOOL} list -- "${@}" | wc -l) + if [ ${?} != 0 ]; then + info "Failed to get exeter manifest for ${@}" pause_continue \ "Press any key to pause test session" \ "Resuming in " \ @@ -43,13 +43,13 @@ exeter() { return fi - status_file_start "$* (exeter)" ${__ntests} + status_file_start "${*} (exeter)" ${__ntests} [ ${CI} -eq 1 ] && video_link "${1}" - for __testid in $($EXETOOL list -- "$@"); do - __desc="$($EXETOOL desc -- "$@" -- ${__testid})" + for __testid in $(${EXETOOL} list -- "${@}"); do + __desc="$(${EXETOOL} desc -- "${@}" -- ${__testid})" status_test_start "${__desc}" - context_run host "$@" "${__testid}" && status_test_ok || status_test_fail + context_run host "${@}" "${__testid}" && status_test_ok || status_test_fail done cd .. -- 2.51.0

1 0

[PATCH 0/2] Fixes to exeter test integration
by David Gibson 10 Oct '25

10 Oct '25

In advance of the tunbridge work, here are some further small fixes to the test logic, specifically how we interface with exeter tests. David Gibson (2): test: Add some missing quoting in exeter runner test: For missing static checkers, skip rather than failing tests test/build/static_checkers.sh | 17 +++++++++++++---- test/lib/exeter | 12 ++++++++++-- 2 files changed, 23 insertions(+), 6 deletions(-) -- 2.51.0

2 6

[PATCH v12 0/9] Use true MAC address of LAN local remote hosts
by Jon Maloy 10 Oct '25

10 Oct '25

Bug #120 asks us to use the true MAC addresses of LAN local remote hosts, since some programs need this information. These commits introduces this for ARP, NDP, UDP, TCP and ICMP. --- v3: Updated according to feedback from Stefano and David: - Made the ARP/NDP lookup call filter out the requested address by itself, qualified by the index if the template interface - Moved the flow specific MAC address from struct flowside to struct flow_common. v4: - Updated according to feedback from David and Stefan - Added a cache table for ARP/NDP table contents v5: - Updated according to feedback from David and Stefan - Added cache table entries to FIFO/LRU queue - New criteria for when to consult ARP/NDP v6: - Simplified and merged mac cache table commits - Other changes after feedback from David. v7: - Fixes in patch #2 based on feedback from David and Stefano. v8: - Redesigned netlink and cache table part to be based on a subscription model. v8: - Small fix to patch #2 so that we cover the case when a MAC addess for a host has changed. - Added a commit where we send a gratuitous ARP/ unsolicitated NA to the guest when a new host is added to the neighbour cache table. v10: - Some fixes after feedback from David Gibson - Reordered: Moved patch #9 to position #3. - Added synchronization step between ARP/NDP table contents and the neigbour table at initialization. This reduces the number of "false" ARP/NDP replies drastically, but not completly. - (Next step could be to scan over the flow table and update affeced entries when we receive a MAC address update.) v11: - Corrected the gratuitous ARP implementation to use the "ARP Announcement" model instead of the "Gratuitous ARP reply" model. v12: - Updated based on feedback from David and Stefano - Added special handling of default GW and loopback addresses. Jon Maloy (8): netlink: add subsciption on changes in NDP/ARP table fwd: Add cache table for ARP/NDP contents arp/ndp: respond with true MAC address of LAN local remote hosts flow: add MAC address of LAN local remote hosts to flow udp: forward external source MAC address through tap interface tcp: forward external source MAC address through tap interface tap: change signature of function tap_push_l2h() icmp: let icmp use mac address from flowside structure arp.c | 9 ++- conf.c | 1 + epoll_type.h | 2 + flow.c | 2 + flow.h | 2 + fwd.c | 167 +++++++++++++++++++++++++++++++++++++++++++++++-- fwd.h | 9 +++ icmp.c | 8 ++- inany.c | 1 + ndp.c | 10 ++- netlink.c | 119 +++++++++++++++++++++++++++++++++++ netlink.h | 4 ++ passt.c | 17 +++-- passt.h | 3 +- pasta.c | 2 +- tap.c | 24 ++++--- tap.h | 7 ++- tcp.c | 18 ++++-- tcp.h | 2 +- tcp_buf.c | 37 +++++------ tcp_internal.h | 4 +- tcp_vu.c | 5 +- udp.c | 57 ++++++++++------- udp.h | 2 +- 24 files changed, 429 insertions(+), 83 deletions(-) -- 2.50.1

3 32

[PATCH 0/4] tcp: Fix bad switch to CLOSE-WAIT state and surrounding issues
by Stefano Brivio 09 Oct '25

09 Oct '25

The most important fix here is 3/4, the other ones are either fixes for issues that weren't actually observed in practice, but I mistook them as the case fixed by 3/4, or for minor details. Stefano Brivio (4): tcp: Fix ACK sequence on FIN to tap tcp: Completely ignore data segment in CLOSE-WAIT state, log a message tcp: Don't consider FIN flags with mismatching sequence tcp: On partial send (incomplete sendmsg()), request a retransmission right away tcp.c | 12 +++++++++--- tcp_buf.c | 14 +++++++++++++- tcp_vu.c | 7 ++++++- 3 files changed, 28 insertions(+), 5 deletions(-) -- 2.43.0

2 24

[PATCH v2] isolation: keep CAP_DAC_OVERRIDE initially
by Cole Robinson 09 Oct '25

09 Oct '25

Reproducer that I'd expect to work: $ cd $HOME $ sudo passt --runas $UID --socket foo.sock Failed to bind UNIX domain socket: Permission denied A more practical example is for libguestfs apps when run as user=root: + libguestfs connects to libvirt qemu:///system + libvirt qemu:///system defaults to user=qemu + libvirt chowns /run/libvirt/qemu/passt dir to user=qemu + libguestfs instead requests the VM run as user=root + patches in progress but we are blocked by this issue + passt is launched as root, but because CAP_DAC_OVERRIDE has been dropped, passt fails to create socket in qemu owned /run/libvirt/qemu/passt Fix it by not dropping CAP_DAC_OVERRIDE in isolate_initial. This might look sketchy, but isolate_initial already keeps CAP_SYS_ADMIN and CAP_NET_ADMIN, so we are probably no worse off. Reviewed-by: David Gibson <david(a)gibson.dropbear.id.au> Signed-off-by: Cole Robinson <crobinso(a)redhat.com> --- v2: improve commit message isolation.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/isolation.c b/isolation.c index bbcd23b..b25f349 100644 --- a/isolation.c +++ b/isolation.c @@ -188,6 +188,9 @@ void isolate_initial(int argc, char **argv) * We have to keep CAP_SETUID and CAP_SETGID at this stage, so * that we can switch user away from root. * + * CAP_DAC_OVERRIDE may be required for socket setup when combined + * with --runas. + * * We have to keep some capabilities for the --netns-only case: * - CAP_SYS_ADMIN, so that we can setns() to the netns. * - Keep CAP_NET_ADMIN, so that we can configure interfaces @@ -198,7 +201,7 @@ void isolate_initial(int argc, char **argv) * isolate_prefork(). */ keep = BIT(CAP_NET_BIND_SERVICE) | BIT(CAP_SETUID) | BIT(CAP_SETGID) | - BIT(CAP_SYS_ADMIN) | BIT(CAP_NET_ADMIN); + BIT(CAP_SYS_ADMIN) | BIT(CAP_NET_ADMIN) | BIT(CAP_DAC_OVERRIDE); /* Since Linux 5.12, if we want to update /proc/self/uid_map to create * a mapping from UID 0, which only happens with pasta spawning a child -- 2.51.0

2 1