On Tue, 11 Oct 2022 16:40:15 +1100
David Gibson
@@ -251,7 +275,19 @@ int isolate_prefork(struct ctx *c) return -errno; }
- drop_caps(); /* Relative to the new user namespace this time. */ + /* Drop capabilites in our new userns */ + if (c->mode == MODE_PASTA) { + /* Keep CAP_SYS_ADMIN, so that we can setns() to the + * netns when we need to act upon it + */ + ns_caps |= 1UL << CAP_SYS_ADMIN; + /* Keep CAP_NET_BIND_SERVICE, so we can splice + * outbound connections to low port numbers + */ + ns_caps |= 1UL << CAP_NET_BIND_SERVICE; + } + + drop_caps_ep_except(ns_caps);
Hmm, I didn't really look into this yet, but there seems to be an issue
with filesystem-bound network namespaces now. Running something like:
pasta --config-net --netns /run/user/1000/netns/netns-6466ff4b-1efc-2b58-685b-cbc12feb9ccc
(from Podman), this happens:
readlink("/proc/self/exe", "/usr/local/bin/passt.avx2", 4095) = 25
capget({version=_LINUX_CAPABILITY_VERSION_3, pid=0}, {effective=1<