From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1761166AbYB1PrT (ORCPT ); Thu, 28 Feb 2008 10:47:19 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1759276AbYB1PrH (ORCPT ); Thu, 28 Feb 2008 10:47:07 -0500 Received: from sacred.ru ([62.205.161.221]:37739 "EHLO sacred.ru" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1758583AbYB1PrG (ORCPT ); Thu, 28 Feb 2008 10:47:06 -0500 Message-ID: <47C6D743.1050802@openvz.org> Date: Thu, 28 Feb 2008 18:46:11 +0300 From: Pavel Emelyanov User-Agent: Thunderbird 2.0.0.12 (X11/20080213) MIME-Version: 1.0 To: Andrew Morton , David Miller CC: Alexey Dobriyan , Linux Netdev List , Linux Kernel Mailing List , "Eric W. Biederman" Subject: [PATCH 0/2] Fix /proc/net in presence of net namespaces Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Greylist: Sender succeeded SMTP AUTH authentication, not delayed by milter-greylist-3.0 (sacred.ru [62.205.161.221]); Thu, 28 Feb 2008 18:46:06 +0300 (MSK) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Current /proc/net is done with so called "shadows", but current implementation is broken and has little chances to get fixed. The problem is that dentries subtree of /proc/net directory has fancy revalidation rules to make processes living in different net namespaces see different entries in /proc/net subtree, but currently, tasks see in the /proc/net subdir the contents of any other namespace, depending on who opened the file first. The proposed fix is to turn /proc/net into a symlink, which behaves similar to /proc/self link - it points to .netns/ directory where the is the id of net namespace, current task lives in. # ls -l /proc/net lrwxrwxrwx 1 root root 8 Feb 28 18:38 /proc/net -> .netns/0 The /proc/.netns dir contains subtrees for all the namespaces in the system: # ls -l /proc/.netns/ total 0 dr-xr-xr-x 5 root root 0 Feb 28 18:39 0 dr-xr-xr-x 3 root root 0 Feb 28 18:39 1 To provide some security each /proc/.netns/ directory allows access to tasks that live in the owning namespace only (with the exception, that init_net tasks can see everything). Signed-off-by: Pavel Emelyanov