[lxc-devel] [lxc/lxc] 1bd8d7: lxc-user-nic: test privilege over netns on delete
GitHub
noreply at github.com
Thu Aug 31 17:15:24 UTC 2017
Branch: refs/heads/master
Home: https://github.com/lxc/lxc
Commit: 1bd8d726a7449c7b8b7e0ca84c4bae0ff193f8a8
https://github.com/lxc/lxc/commit/1bd8d726a7449c7b8b7e0ca84c4bae0ff193f8a8
Author: Christian Brauner <christian.brauner at ubuntu.com>
Date: 2017-08-31 (Thu, 31 Aug 2017)
Changed paths:
M src/lxc/lxc_user_nic.c
M src/lxc/network.c
M src/lxc/network.h
M src/lxc/start.c
Log Message:
-----------
lxc-user-nic: test privilege over netns on delete
When lxc-user-nic is called with the "delete" subcommand we need to make sure
that we are actually privileged over the network namespace for which we are
supposed to delete devices on the host. To this end we require that path to the
affected network namespace is passed. We then setns() to the network namespace
and drop privilege to the caller's real user id. Then we try to delete the
loopback interface which is not possible. If we are privileged over the network
namespace this operation will fail with ENOTSUP. If we are not privileged over
the network namespace we will get EPERM.
This is the first part of the commit. As of now nothing guarantees that the
caller does not just give us a random path to a network namespace it is
privileged over.
Signed-off-by: Christian Brauner <christian.brauner at ubuntu.com>
Commit: 8ce727fcd97e114a44f2d528016efc20b1dda92b
https://github.com/lxc/lxc/commit/8ce727fcd97e114a44f2d528016efc20b1dda92b
Author: Christian Brauner <christian.brauner at ubuntu.com>
Date: 2017-08-31 (Thu, 31 Aug 2017)
Changed paths:
M src/lxc/confile_utils.c
Log Message:
-----------
network: log veth_attr.pair and veth_attr.veth1
If the user specified lxc.net.[i].veth.pair attribute to request that the host
side of a veth pair be given a specific name let's log it at the trace level.
Otherwise, if the user didn't not specify lxc.net.[i].veth.pair veth_attr.veth1
will contain the name of the host side veth device.
Signed-off-by: Christian Brauner <christian.brauner at ubuntu.com>
Commit: 4239e9c3bbf181c03b283018ee87bd3d8bb98a93
https://github.com/lxc/lxc/commit/4239e9c3bbf181c03b283018ee87bd3d8bb98a93
Author: Christian Brauner <christian.brauner at ubuntu.com>
Date: 2017-08-31 (Thu, 31 Aug 2017)
Changed paths:
M src/lxc/network.h
Log Message:
-----------
network: add ifindex field for host veth device
We should not just record the ifindex for the container's veth device but also
for the host's veth device. This is useful when {configuring,deconfiguring}
veth devices and becomes crucial when calling our lxc-user-nic setuid helper
where we rely on the ifindex to make decisions about whether we are licensed to
perform certain operations on the veth device in question.
Signed-off-by: Christian Brauner <christian.brauner at ubuntu.com>
Commit: 085bb443cc9433c2c6f9665c5ed3393cb49c99a8
https://github.com/lxc/lxc/commit/085bb443cc9433c2c6f9665c5ed3393cb49c99a8
Author: Christian Brauner <christian.brauner at ubuntu.com>
Date: 2017-08-31 (Thu, 31 Aug 2017)
Changed paths:
M src/lxc/network.h
Log Message:
-----------
network: document all fields in struct lxc_netdev
This is menial work but I'll thank myself later... a lot.
Signed-off-by: Christian Brauner <christian.brauner at ubuntu.com>
Commit: d952b351d27147f528af4aa257cb3a0b5fada34a
https://github.com/lxc/lxc/commit/d952b351d27147f528af4aa257cb3a0b5fada34a
Author: Christian Brauner <christian.brauner at ubuntu.com>
Date: 2017-08-31 (Thu, 31 Aug 2017)
Changed paths:
M src/lxc/confile_utils.c
Log Message:
-----------
network: log ifindex for host side veth device
Signed-off-by: Christian Brauner <christian.brauner at ubuntu.com>
Commit: 74c6e2b015147f345f144a23fcee2eee86c0534e
https://github.com/lxc/lxc/commit/74c6e2b015147f345f144a23fcee2eee86c0534e
Author: Christian Brauner <christian.brauner at ubuntu.com>
Date: 2017-08-31 (Thu, 31 Aug 2017)
Changed paths:
M src/lxc/lxc_user_nic.c
M src/lxc/network.c
M src/lxc/network.h
M src/lxc/start.c
Log Message:
-----------
network: rework network creation
- On unprivileged veth network creation have lxc-user-nic send the names of the
veth devices and their respective ifindeces. The advantage of retrieving this
information from lxc-user-nic is that we spare us sending around more stuff
via the netpipe in start.c. Also, lxc-user-nic operates in both namespaces
(the container's namespace and the hosts's namespace) via setns and so is
guaranteed to retrieve the correct ifindex via if_nametoindex() which is an
network namespace aware ioctl() call. While I'm pretty sure the ifindeces for
veth devices are identical across network namespaces I'm weary to rely on
this. We need the ifindexes to guarantee safe deletion of unprivileged
network devices via lxc-user-nic later on since we use them to identify the
network devices in their corresponding network namespaces.
- Move the network device logging from the child to the parent. The child does
not have all of the information about the network devices available only the
few bits it actually needs to now. The monitor process is the only process
that needs all this information.
- The network creation code for privileged and unprivileged networks was
previously mangled into one single function but at the same time some of the
privileged code had additional functions that were called in other places in
start.c. Let's divide and conquer and split out the privileged and
unprivileged network creation into completely separate functions. This makes
what's happening way more clear. This will also have no performance impact
since either you are privileged and only execute the privileged network
creation functions or you are unprivileged and only execute the unprivileged
network creation functions.
Signed-off-by: Christian Brauner <christian.brauner at ubuntu.com>
Commit: 94a182afcc9581311e8d1ad538580d8551cb0a52
https://github.com/lxc/lxc/commit/94a182afcc9581311e8d1ad538580d8551cb0a52
Author: Serge Hallyn <serge at hallyn.com>
Date: 2017-08-31 (Thu, 31 Aug 2017)
Changed paths:
M src/lxc/confile_utils.c
M src/lxc/lxc_user_nic.c
M src/lxc/network.c
M src/lxc/network.h
M src/lxc/start.c
Log Message:
-----------
Merge pull request #1772 from brauner/2017-08-31/ensure_lxc_user_nic_tests_privilege_over_netns
lxc-user-nic: test privilege over netns on delete
Compare: https://github.com/lxc/lxc/compare/70a498157a8d...94a182afcc95
More information about the lxc-devel
mailing list