Thread (21 messages) 21 messages, 6 authors, 2010-02-26

Re: RFC: netfilter: nf_conntrack: add support for "conntrack zones"

From: Eric W. Biederman <hidden>
Date: 2010-02-23 14:07:32
Also in: netfilter-devel

Possibly related (same subject, not in this thread)

jamal [off-list ref] writes:
On Mon, 2010-02-22 at 15:17 -0800, Eric W. Biederman wrote:
quoted
What I am thinking is:

"ip ns <name> route add blah" is:
fd = open("/var/run/netns/<name>");
sys_setns(fd);  /* Like unshare but takes an existing namespace */
/* Then the rest of the existing ip command */
The other two below make some sense; For the above:
Does the point after sys_setns(fd) allow me to do io inside
ns <name>? Can i do open() and get a fd from ns <name>?
Yes.  My intention is that current->nsproxy->net_ns be changed.
We can already change it in unshare so this is feasible.
quoted
"ip ns list" is:
dfd = open("/var/run/netns", O_DIRECTORY);
getdents(dfd, buf, count);

"ip ns new <name>" is:
unshare(CLONE_NEWNS);
fd = nsfd(NETNS);
mkdir("/var/run/netns/<name>");
mount("none", "/var/run/netns/<name>", "ns", 0, fd);

Using unix domain names means that which namespaces you see is under
control of userspace.  Which allows for nested containers (something I
use today), and ultimately container migration.
The only problem that i see is events are not as nice. I take it i am 
going to get something like an inotify when a new namespace is created?
Yes.  Inotify would at the very least see that mkdir.  You could also
use poll on /proc/mounts to see the set of mounts change.
quoted
Using genetlink userspace doesn't result in a nestable implementation
unless I introduce yet another namespace, ugh.
Is it not just a naming convention that you are dealing with?
Example in your scheme above a nested namespace shows up as:
/var/run/netns/<name>/<nestedname>, no?
No.  More like:

For the outer namespace:
/var/run/netns/<name>

For the inner namespace:
/some/random/fs/path/to/a/chroot/var/run/netns/<name>

For a doubly nested scenario:
/some/random/fs/path/to/a/chroot/some/other/random/fs/path/to/another/chroot/var/run/netns/<name>

Since I would be using mount namespaces instead of chroot it is not
strictly required that the fs paths nest at all.

Eric



Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help