On Sun, May 14, 2023 at 08:14:07PM +0200, Stefano Brivio wrote:In pasta_wait_for_ns(), open() failing with ENOENT is expected: we're busy-looping until the network namespace appears. But any other failure is not something we're going to recover from: return right away if we don't get either success or ENOENT. Now that pasta_wait_for_ns() can actually fail, handle that in pasta_start_ns() by reporting the issue and exiting. Looping on EPERM, when pasta doesn't actually have the permissions to join a given namespace, isn't exactly a productive thing to do. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com>Reviewed-by: David Gibson <david(a)gibson.dropbear.id.au> Also makes sense regardless of the rest of the series.--- pasta.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/pasta.c b/pasta.c index 3a4d704..2fa0168 100644 --- a/pasta.c +++ b/pasta.c @@ -94,8 +94,11 @@ static int pasta_wait_for_ns(void *arg) char ns[PATH_MAX]; snprintf(ns, PATH_MAX, "/proc/%i/ns/net", pasta_child_pid); - do - while ((c->pasta_netns_fd = open(ns, flags)) < 0); + while ((c->pasta_netns_fd = open(ns, flags)) < 0) { + if (errno != ENOENT) + return 0; + } + while (setns(c->pasta_netns_fd, CLONE_NEWNET) && !close(c->pasta_netns_fd)); @@ -252,6 +255,8 @@ void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid, } NS_CALL(pasta_wait_for_ns, c); + if (c->pasta_netns_fd < 0) + die("Failed to join network namespace"); } /**-- David Gibson | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you. NOT _the_ _other_ | _way_ _around_! http://www.ozlabs.org/~dgibson