On Wed, 1 Feb 2023 19:01:16 +0100
Paul Holzinger <pholzing(a)redhat.com> wrote:
When a user spawns a command with pasta they
expect the network to be
ready. Currently this does not work because pasta will fork/exec
before it will setup the network config.
This patch fixes it by using a pipe to sync parent and child. The child
will now block reading from this pipe before the exec call. The parent
will then unblock the child only after the netns was configured.
Thanks for the
patch! I'm reviewing this in a bit.
A few considerations meanwhile:
- there's actually a bigger issue (you're fixing here) than the
namespace configuration (via netlink) itself: the tap device isn't
ready (tap_sock_init() hasn't been called yet) when we spawn the
command in the new namespace. Oops.
If you're wondering: we can't just reorder things, because to complete
the configuration phase (conf()) we need the namespace to be set up,
and we can't initialise the tap device before it's set up
- pipes are more commonly used to transfer data around (hence the whole
code you need to open a communication channel, check it, close it).
Did you try with a signal? Or is there a reason why it wouldn't work?
You could simply SIGSTOP the child, from the child itself:
kill(getpid(), SIGSTOP);
and send a SIGCONT to it (we already store the PID of the child in
pasta_child_pid) once we're ready.
SIGCONT is special in that it doesn't need CAP_KILL or the processes
to run under the same UID -- just in the same session, so it wouldn't
risk interfering with the isolation_*() calls.
I haven't tested this but I think it should lead to simpler code.