36e8a3
From 2115fcc1e673079fe76e949ac0904267075c25a4 Mon Sep 17 00:00:00 2001
36e8a3
From: Lennart Poettering <lennart@poettering.net>
36e8a3
Date: Wed, 31 Oct 2018 13:04:20 +0100
36e8a3
Subject: [PATCH] nspawn: beef up netns checking a bit, for compat with old
36e8a3
 kernels
36e8a3
36e8a3
Fixes: #10544
36e8a3
36e8a3
Cherry-picked from: 6619ad889da260cf83079cc74a85d571acd1df5a
36e8a3
---
36e8a3
 src/basic/stat-util.c     | 40 +++++++++++++++++++++++++++++++++++----
36e8a3
 src/nspawn/nspawn.c       |  8 +++++---
36e8a3
 src/test/test-stat-util.c | 15 +++++++++++++++
36e8a3
 3 files changed, 56 insertions(+), 7 deletions(-)
36e8a3
36e8a3
diff --git a/src/basic/stat-util.c b/src/basic/stat-util.c
4bff0a
index 07154e25bb..26aee9bad6 100644
36e8a3
--- a/src/basic/stat-util.c
36e8a3
+++ b/src/basic/stat-util.c
36e8a3
@@ -204,15 +204,47 @@ int fd_is_network_fs(int fd) {
36e8a3
 }
36e8a3
 
36e8a3
 int fd_is_network_ns(int fd) {
36e8a3
+        struct statfs s;
36e8a3
         int r;
36e8a3
 
36e8a3
-        r = fd_is_fs_type(fd, NSFS_MAGIC);
36e8a3
-        if (r <= 0)
36e8a3
-                return r;
36e8a3
+        /* Checks whether the specified file descriptor refers to a network namespace. On old kernels there's no nice
36e8a3
+         * way to detect that, hence on those we'll return a recognizable error (EUCLEAN), so that callers can handle
36e8a3
+         * this somewhat nicely.
36e8a3
+         *
36e8a3
+         * This function returns > 0 if the fd definitely refers to a network namespace, 0 if it definitely does not
36e8a3
+         * refer to a network namespace, -EUCLEAN if we can't determine, and other negative error codes on error. */
36e8a3
+
36e8a3
+        if (fstatfs(fd, &s) < 0)
36e8a3
+                return -errno;
36e8a3
+
36e8a3
+        if (!is_fs_type(&s, NSFS_MAGIC)) {
36e8a3
+                /* On really old kernels, there was no "nsfs", and network namespace sockets belonged to procfs
36e8a3
+                 * instead. Handle that in a somewhat smart way. */
36e8a3
+
36e8a3
+                if (is_fs_type(&s, PROC_SUPER_MAGIC)) {
36e8a3
+                        struct statfs t;
36e8a3
+
36e8a3
+                        /* OK, so it is procfs. Let's see if our own network namespace is procfs, too. If so, then the
36e8a3
+                         * passed fd might refer to a network namespace, but we can't know for sure. In that case,
36e8a3
+                         * return a recognizable error. */
36e8a3
+
36e8a3
+                        if (statfs("/proc/self/ns/net", &t) < 0)
36e8a3
+                                return -errno;
36e8a3
+
36e8a3
+                        if (s.f_type == t.f_type)
36e8a3
+                                return -EUCLEAN; /* It's possible, we simply don't know */
36e8a3
+                }
36e8a3
+
36e8a3
+                return 0; /* No! */
36e8a3
+        }
36e8a3
 
36e8a3
         r = ioctl(fd, NS_GET_NSTYPE);
36e8a3
-        if (r < 0)
36e8a3
+        if (r < 0) {
36e8a3
+                if (errno == ENOTTY) /* Old kernels didn't know this ioctl, let's also return a recognizable error in that case */
36e8a3
+                        return -EUCLEAN;
36e8a3
+
36e8a3
                 return -errno;
36e8a3
+        }
36e8a3
 
36e8a3
         return r == CLONE_NEWNET;
36e8a3
 }
36e8a3
diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
4bff0a
index 56877bd932..8aec893a69 100644
36e8a3
--- a/src/nspawn/nspawn.c
36e8a3
+++ b/src/nspawn/nspawn.c
36e8a3
@@ -3701,10 +3701,12 @@ static int run(int master,
36e8a3
                         return log_error_errno(errno, "Cannot open file %s: %m", arg_network_namespace_path);
36e8a3
 
36e8a3
                 r = fd_is_network_ns(netns_fd);
36e8a3
-                if (r < 0 && r != -ENOTTY)
36e8a3
+                if (r == -EUCLEAN)
36e8a3
+                        log_debug_errno(r, "Cannot determine if passed network namespace path '%s' really refers to a network namespace, assuming it does.", arg_network_namespace_path);
36e8a3
+                else if (r < 0)
36e8a3
                         return log_error_errno(r, "Failed to check %s fs type: %m", arg_network_namespace_path);
36e8a3
-                if (r == 0) {
36e8a3
-                        log_error("Path %s doesn't refer to a network namespace", arg_network_namespace_path);
36e8a3
+                else if (r == 0) {
36e8a3
+                        log_error("Path %s doesn't refer to a network namespace, refusing.", arg_network_namespace_path);
36e8a3
                         return -EINVAL;
36e8a3
                 }
36e8a3
         }
36e8a3
diff --git a/src/test/test-stat-util.c b/src/test/test-stat-util.c
4bff0a
index 43f56a6c20..2b0564d8a0 100644
36e8a3
--- a/src/test/test-stat-util.c
36e8a3
+++ b/src/test/test-stat-util.c
36e8a3
@@ -67,11 +67,26 @@ static void test_path_is_temporary_fs(void) {
36e8a3
         assert_se(path_is_temporary_fs("/i-dont-exist") == -ENOENT);
36e8a3
 }
36e8a3
 
36e8a3
+static void test_fd_is_network_ns(void) {
36e8a3
+        _cleanup_close_ int fd = -1;
36e8a3
+        assert_se(fd_is_network_ns(STDIN_FILENO) == 0);
36e8a3
+        assert_se(fd_is_network_ns(STDERR_FILENO) == 0);
36e8a3
+        assert_se(fd_is_network_ns(STDOUT_FILENO) == 0);
36e8a3
+
36e8a3
+        assert_se((fd = open("/proc/self/ns/mnt", O_CLOEXEC|O_RDONLY)) >= 0);
36e8a3
+        assert_se(IN_SET(fd_is_network_ns(fd), 0, -EUCLEAN));
36e8a3
+        fd = safe_close(fd);
36e8a3
+
36e8a3
+        assert_se((fd = open("/proc/self/ns/net", O_CLOEXEC|O_RDONLY)) >= 0);
36e8a3
+        assert_se(IN_SET(fd_is_network_ns(fd), 1, -EUCLEAN));
36e8a3
+}
36e8a3
+
36e8a3
 int main(int argc, char *argv[]) {
36e8a3
         test_files_same();
36e8a3
         test_is_symlink();
36e8a3
         test_path_is_fs_type();
36e8a3
         test_path_is_temporary_fs();
36e8a3
+        test_fd_is_network_ns();
36e8a3
 
36e8a3
         return 0;
36e8a3
 }