SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

nspawn: introduce an option for specifying network namespace path

Browse Source 
Add a new option `--network-namespace-path` to systemd-nspawn to allow
users to specify an arbitrary network namespace, e.g. `/run/netns/foo`.
Then systemd-nspawn will open the netns file, pass the fd to
outer_child, and enter the namespace represented by the fd before
running inner_child.

```
$ sudo ip netns add foo
$ mount | grep /run/netns/foo
nsfs on /run/netns/foo type nsfs (rw)
...
$ sudo systemd-nspawn -D /srv/fc27 --network-namespace-path=/run/netns/foo \
  /bin/readlink -f /proc/self/ns/net
/proc/1/ns/net:[4026532009]
```

Note that the option `--network-namespace-path=` cannot be used together
with other network-related options such as `--private-network` so that
the options do not conflict with each other.

Fixes https://github.com/systemd/systemd/issues/7361
This commit is contained in:
Dongsu Park
2017-12-13 10:21:06 +00:00
committed by Iago López Galeiras
parent cb9eeb062c
commit d7bea6b629
5 changed files with 141 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files
man/systemd-nspawn.xml
+17
View File
@@ -522,6 +522,23 @@
<option>--drop-capability=</option>.</para></listitem> <option>--drop-capability=</option>.</para></listitem>
</varlistentry> </varlistentry>
<varlistentry>
<term><option>--network-namespace-path=</option></term>
<listitem><para>Takes the path to a file representing a kernel
network namespace that the container shall run in. The specified path
should refer to a (possibly bind-mounted) network namespace file, as
exposed by the kernel below <filename>/proc/$PID/ns/net</filename>.
This makes the container enter the given network namespace. One of the
typical use cases is to give a network namespace under
<filename>/run/netns</filename> created by <citerefentry
project='man-pages'><refentrytitle>ip-netns</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
for example, <option>--network-namespace-path=/run/netns/foo</option>.
Note that this option cannot be used together with other
network-related options, such as <option>--private-network</option>
or <option>--network-interface=</option>.</para></listitem>
</varlistentry>
<varlistentry> <varlistentry>
<term><option>--network-interface=</option></term> <term><option>--network-interface=</option></term>
src/basic/missing.h
+8
View File
@@ -1271,4 +1271,12 @@ struct fib_rule_uid_range {
# define EXT4_IOC_RESIZE_FS _IOW('f', 16, __u64) # define EXT4_IOC_RESIZE_FS _IOW('f', 16, __u64)
#endif #endif
#ifndef NSFS_MAGIC
#define NSFS_MAGIC 0x6e736673
#endif
#ifndef NS_GET_NSTYPE
#define NS_GET_NSTYPE _IO(0xb7, 0x3)
#endif
#include "missing_syscall.h" #include "missing_syscall.h"
src/basic/stat-util.c
+12
View File
@@ -226,6 +226,18 @@ int fd_is_temporary_fs(int fd) {
return is_temporary_fs(&s); return is_temporary_fs(&s);
} }
int fd_is_network_ns(int fd) {
int r;
r = fd_is_fs_type(fd, NSFS_MAGIC);
if (r <= 0)
return r;
r = ioctl(fd, NS_GET_NSTYPE);
if (r < 0)
return -errno;
return r == CLONE_NEWNET;
}
int path_is_temporary_fs(const char *path) { int path_is_temporary_fs(const char *path) {
_cleanup_close_ int fd = -1; _cleanup_close_ int fd = -1;
src/basic/stat-util.h
+1
View File
@@ -62,6 +62,7 @@ int path_is_fs_type(const char *path, statfs_f_type_t magic_value);
bool is_temporary_fs(const struct statfs *s) _pure_; bool is_temporary_fs(const struct statfs *s) _pure_;
int fd_is_temporary_fs(int fd); int fd_is_temporary_fs(int fd);
int fd_is_network_ns(int fd);
int path_is_temporary_fs(const char *path); int path_is_temporary_fs(const char *path);
/* Because statfs.t_type can be int on some architectures, we have to cast /* Because statfs.t_type can be int on some architectures, we have to cast
src/nspawn/nspawn.c
+103 -52
View File
@@ -190,6 +190,7 @@ static bool arg_network_veth = false;
static char **arg_network_veth_extra = NULL; static char **arg_network_veth_extra = NULL;
static char *arg_network_bridge = NULL; static char *arg_network_bridge = NULL;
static char *arg_network_zone = NULL; static char *arg_network_zone = NULL;
static char *arg_network_namespace_path = NULL;
static unsigned long arg_personality = PERSONALITY_INVALID; static unsigned long arg_personality = PERSONALITY_INVALID;
static char *arg_image = NULL; static char *arg_image = NULL;
static VolatileMode arg_volatile_mode = VOLATILE_NO; static VolatileMode arg_volatile_mode = VOLATILE_NO;
@@ -260,6 +261,9 @@ static void help(void) {
" and attach it to an existing bridge on the host\n" " and attach it to an existing bridge on the host\n"
" --network-zone=NAME Similar, but attach the new interface to an\n" " --network-zone=NAME Similar, but attach the new interface to an\n"
" an automatically managed bridge interface\n" " an automatically managed bridge interface\n"
" --network-namespace-path=PATH\n"
" Set network namespace to the one represented by\n"
" the specified kernel namespace file node\n"
" -p --port=[PROTOCOL:]HOSTPORT[:CONTAINERPORT]\n" " -p --port=[PROTOCOL:]HOSTPORT[:CONTAINERPORT]\n"
" Expose a container IP port on the host\n" " Expose a container IP port on the host\n"
" -Z --selinux-context=SECLABEL\n" " -Z --selinux-context=SECLABEL\n"
@@ -434,6 +438,7 @@ static int parse_argv(int argc, char *argv[]) {
ARG_NETWORK_BRIDGE, ARG_NETWORK_BRIDGE,
ARG_NETWORK_ZONE, ARG_NETWORK_ZONE,
ARG_NETWORK_VETH_EXTRA, ARG_NETWORK_VETH_EXTRA,
ARG_NETWORK_NAMESPACE_PATH,
ARG_PERSONALITY, ARG_PERSONALITY,
ARG_VOLATILE, ARG_VOLATILE,
ARG_TEMPLATE, ARG_TEMPLATE,
@@ -450,55 +455,56 @@ static int parse_argv(int argc, char *argv[]) {
}; };
static const struct option options[] = { static const struct option options[] = {
{ "help", no_argument, NULL, 'h' }, { "help", no_argument, NULL, 'h' },
{ "version", no_argument, NULL, ARG_VERSION }, { "version", no_argument, NULL, ARG_VERSION },
{ "directory", required_argument, NULL, 'D' }, { "directory", required_argument, NULL, 'D' },
{ "template", required_argument, NULL, ARG_TEMPLATE }, { "template", required_argument, NULL, ARG_TEMPLATE },
{ "ephemeral", no_argument, NULL, 'x' }, { "ephemeral", no_argument, NULL, 'x' },
{ "user", required_argument, NULL, 'u' }, { "user", required_argument, NULL, 'u' },
{ "private-network", no_argument, NULL, ARG_PRIVATE_NETWORK }, { "private-network", no_argument, NULL, ARG_PRIVATE_NETWORK },
{ "as-pid2", no_argument, NULL, 'a' }, { "as-pid2", no_argument, NULL, 'a' },
{ "boot", no_argument, NULL, 'b' }, { "boot", no_argument, NULL, 'b' },
{ "uuid", required_argument, NULL, ARG_UUID }, { "uuid", required_argument, NULL, ARG_UUID },
{ "read-only", no_argument, NULL, ARG_READ_ONLY }, { "read-only", no_argument, NULL, ARG_READ_ONLY },
{ "capability", required_argument, NULL, ARG_CAPABILITY }, { "capability", required_argument, NULL, ARG_CAPABILITY },
{ "drop-capability", required_argument, NULL, ARG_DROP_CAPABILITY }, { "drop-capability", required_argument, NULL, ARG_DROP_CAPABILITY },
{ "link-journal", required_argument, NULL, ARG_LINK_JOURNAL }, { "link-journal", required_argument, NULL, ARG_LINK_JOURNAL },
{ "bind", required_argument, NULL, ARG_BIND }, { "bind", required_argument, NULL, ARG_BIND },
{ "bind-ro", required_argument, NULL, ARG_BIND_RO }, { "bind-ro", required_argument, NULL, ARG_BIND_RO },
{ "tmpfs", required_argument, NULL, ARG_TMPFS }, { "tmpfs", required_argument, NULL, ARG_TMPFS },
{ "overlay", required_argument, NULL, ARG_OVERLAY }, { "overlay", required_argument, NULL, ARG_OVERLAY },
{ "overlay-ro", required_argument, NULL, ARG_OVERLAY_RO }, { "overlay-ro", required_argument, NULL, ARG_OVERLAY_RO },
{ "machine", required_argument, NULL, 'M' }, { "machine", required_argument, NULL, 'M' },
{ "slice", required_argument, NULL, 'S' }, { "slice", required_argument, NULL, 'S' },
{ "setenv", required_argument, NULL, 'E' }, { "setenv", required_argument, NULL, 'E' },
{ "selinux-context", required_argument, NULL, 'Z' }, { "selinux-context", required_argument, NULL, 'Z' },
{ "selinux-apifs-context", required_argument, NULL, 'L' }, { "selinux-apifs-context", required_argument, NULL, 'L' },
{ "quiet", no_argument, NULL, 'q' }, { "quiet", no_argument, NULL, 'q' },
{ "share-system", no_argument, NULL, ARG_SHARE_SYSTEM }, /* not documented */ { "share-system", no_argument, NULL, ARG_SHARE_SYSTEM }, /* not documented */
{ "register", required_argument, NULL, ARG_REGISTER }, { "register", required_argument, NULL, ARG_REGISTER },
{ "keep-unit", no_argument, NULL, ARG_KEEP_UNIT }, { "keep-unit", no_argument, NULL, ARG_KEEP_UNIT },
{ "network-interface", required_argument, NULL, ARG_NETWORK_INTERFACE }, { "network-interface", required_argument, NULL, ARG_NETWORK_INTERFACE },
{ "network-macvlan", required_argument, NULL, ARG_NETWORK_MACVLAN }, { "network-macvlan", required_argument, NULL, ARG_NETWORK_MACVLAN },
{ "network-ipvlan", required_argument, NULL, ARG_NETWORK_IPVLAN }, { "network-ipvlan", required_argument, NULL, ARG_NETWORK_IPVLAN },
{ "network-veth", no_argument, NULL, 'n' }, { "network-veth", no_argument, NULL, 'n' },
{ "network-veth-extra", required_argument, NULL, ARG_NETWORK_VETH_EXTRA }, { "network-veth-extra", required_argument, NULL, ARG_NETWORK_VETH_EXTRA },
{ "network-bridge", required_argument, NULL, ARG_NETWORK_BRIDGE }, { "network-bridge", required_argument, NULL, ARG_NETWORK_BRIDGE },
{ "network-zone", required_argument, NULL, ARG_NETWORK_ZONE }, { "network-zone", required_argument, NULL, ARG_NETWORK_ZONE },
{ "personality", required_argument, NULL, ARG_PERSONALITY }, { "network-namespace-path", required_argument, NULL, ARG_NETWORK_NAMESPACE_PATH },
{ "image", required_argument, NULL, 'i' }, { "personality", required_argument, NULL, ARG_PERSONALITY },
{ "volatile", optional_argument, NULL, ARG_VOLATILE }, { "image", required_argument, NULL, 'i' },
{ "port", required_argument, NULL, 'p' }, { "volatile", optional_argument, NULL, ARG_VOLATILE },
{ "property", required_argument, NULL, ARG_PROPERTY }, { "port", required_argument, NULL, 'p' },
{ "private-users", optional_argument, NULL, ARG_PRIVATE_USERS }, { "property", required_argument, NULL, ARG_PROPERTY },
{ "private-users-chown", optional_argument, NULL, ARG_PRIVATE_USERS_CHOWN }, { "private-users", optional_argument, NULL, ARG_PRIVATE_USERS },
{ "kill-signal", required_argument, NULL, ARG_KILL_SIGNAL }, { "private-users-chown", optional_argument, NULL, ARG_PRIVATE_USERS_CHOWN },
{ "settings", required_argument, NULL, ARG_SETTINGS }, { "kill-signal", required_argument, NULL, ARG_KILL_SIGNAL },
{ "chdir", required_argument, NULL, ARG_CHDIR }, { "settings", required_argument, NULL, ARG_SETTINGS },
{ "pivot-root", required_argument, NULL, ARG_PIVOT_ROOT }, { "chdir", required_argument, NULL, ARG_CHDIR },
{ "notify-ready", required_argument, NULL, ARG_NOTIFY_READY }, { "pivot-root", required_argument, NULL, ARG_PIVOT_ROOT },
{ "root-hash", required_argument, NULL, ARG_ROOT_HASH }, { "notify-ready", required_argument, NULL, ARG_NOTIFY_READY },
{ "system-call-filter", required_argument, NULL, ARG_SYSTEM_CALL_FILTER }, { "root-hash", required_argument, NULL, ARG_ROOT_HASH },
{ "system-call-filter", required_argument, NULL, ARG_SYSTEM_CALL_FILTER },
{} {}
}; };
@@ -644,6 +650,13 @@ static int parse_argv(int argc, char *argv[]) {
arg_settings_mask |= SETTING_NETWORK; arg_settings_mask |= SETTING_NETWORK;
break; break;
case ARG_NETWORK_NAMESPACE_PATH:
r = parse_path_argument_and_warn(optarg, false, &arg_network_namespace_path);
if (r < 0)
return r;
break;
case 'b': case 'b':
if (arg_start_mode == START_PID2) { if (arg_start_mode == START_PID2) {
log_error("--boot and --as-pid2 may not be combined."); log_error("--boot and --as-pid2 may not be combined.");
@@ -1103,6 +1116,17 @@ static int parse_argv(int argc, char *argv[]) {
assert_not_reached("Unhandled option"); assert_not_reached("Unhandled option");
} }
/* If --network-namespace-path is given with any other network-related option,
* we need to error out, to avoid conflicts between different network options. */
if (arg_network_namespace_path &&
(arg_network_interfaces || arg_network_macvlan ||
arg_network_ipvlan || arg_network_veth_extra ||
arg_network_bridge || arg_network_zone ||
arg_network_veth || arg_private_network)) {
log_error("--network-namespace-path cannot be combined with other network options.");
return -EINVAL;
}
parse_share_ns_env("SYSTEMD_NSPAWN_SHARE_NS_IPC", CLONE_NEWIPC); parse_share_ns_env("SYSTEMD_NSPAWN_SHARE_NS_IPC", CLONE_NEWIPC);
parse_share_ns_env("SYSTEMD_NSPAWN_SHARE_NS_PID", CLONE_NEWPID); parse_share_ns_env("SYSTEMD_NSPAWN_SHARE_NS_PID", CLONE_NEWPID);
parse_share_ns_env("SYSTEMD_NSPAWN_SHARE_NS_UTS", CLONE_NEWUTS); parse_share_ns_env("SYSTEMD_NSPAWN_SHARE_NS_UTS", CLONE_NEWUTS);
@@ -2532,12 +2556,14 @@ static int outer_child(
int rtnl_socket, int rtnl_socket,
int uid_shift_socket, int uid_shift_socket,
int unified_cgroup_hierarchy_socket, int unified_cgroup_hierarchy_socket,
FDSet *fds) { FDSet *fds,
int netns_fd) {
pid_t pid; pid_t pid;
ssize_t l; ssize_t l;
int r; int r;
_cleanup_close_ int fd = -1; _cleanup_close_ int fd = -1;
bool create_netns;
assert(barrier); assert(barrier);
assert(directory); assert(directory);
@@ -2788,9 +2814,11 @@ static int outer_child(
if (fd < 0) if (fd < 0)
return fd; return fd;
create_netns = !arg_network_namespace_path && arg_private_network;
pid = raw_clone(SIGCHLD|CLONE_NEWNS| pid = raw_clone(SIGCHLD|CLONE_NEWNS|
arg_clone_ns_flags | arg_clone_ns_flags |
(arg_private_network ? CLONE_NEWNET : 0) | (create_netns ? CLONE_NEWNET : 0) |
(arg_userns_mode != USER_NAMESPACE_NO ? CLONE_NEWUSER : 0)); (arg_userns_mode != USER_NAMESPACE_NO ? CLONE_NEWUSER : 0));
if (pid < 0) if (pid < 0)
return log_error_errno(errno, "Failed to fork inner child: %m"); return log_error_errno(errno, "Failed to fork inner child: %m");
@@ -2804,6 +2832,12 @@ static int outer_child(
* requested, so that we all are owned by the user if * requested, so that we all are owned by the user if
* user namespaces are turned on. */ * user namespaces are turned on. */
if (arg_network_namespace_path) {
r = namespace_enter(-1, -1, netns_fd, -1, -1);
if (r < 0)
return r;
}
r = inner_child(barrier, directory, secondary, kmsg_socket, rtnl_socket, fds); r = inner_child(barrier, directory, secondary, kmsg_socket, rtnl_socket, fds);
if (r < 0) if (r < 0)
_exit(EXIT_FAILURE); _exit(EXIT_FAILURE);
@@ -2836,6 +2870,7 @@ static int outer_child(
notify_socket = safe_close(notify_socket); notify_socket = safe_close(notify_socket);
kmsg_socket = safe_close(kmsg_socket); kmsg_socket = safe_close(kmsg_socket);
rtnl_socket = safe_close(rtnl_socket); rtnl_socket = safe_close(rtnl_socket);
netns_fd = safe_close(netns_fd);
return 0; return 0;
} }
@@ -3311,6 +3346,7 @@ static int run(int master,
int ifi = 0, r; int ifi = 0, r;
ssize_t l; ssize_t l;
sigset_t mask_chld; sigset_t mask_chld;
_cleanup_close_ int netns_fd = -1;
assert_se(sigemptyset(&mask_chld) == 0); assert_se(sigemptyset(&mask_chld) == 0);
assert_se(sigaddset(&mask_chld, SIGCHLD) == 0); assert_se(sigaddset(&mask_chld, SIGCHLD) == 0);
@@ -3365,6 +3401,20 @@ static int run(int master,
if (r < 0) if (r < 0)
return log_error_errno(errno, "Failed to install SIGCHLD handler: %m"); return log_error_errno(errno, "Failed to install SIGCHLD handler: %m");
if (arg_network_namespace_path) {
netns_fd = open(arg_network_namespace_path, O_RDONLY|O_NOCTTY|O_CLOEXEC);
if (netns_fd < 0)
return log_error_errno(errno, "Cannot open file %s: %m", arg_network_namespace_path);
r = fd_is_network_ns(netns_fd);
if (r < 0 && r != -ENOTTY)
return log_error_errno(r, "Failed to check %s fs type: %m", arg_network_namespace_path);
if (r == 0) {
log_error("Path %s doesn't refer to a network namespace", arg_network_namespace_path);
return -EINVAL;
}
}
*pid = raw_clone(SIGCHLD|CLONE_NEWNS); *pid = raw_clone(SIGCHLD|CLONE_NEWNS);
if (*pid < 0) if (*pid < 0)
return log_error_errno(errno, "clone() failed%s: %m", return log_error_errno(errno, "clone() failed%s: %m",
@@ -3401,7 +3451,8 @@ static int run(int master,
rtnl_socket_pair[1], rtnl_socket_pair[1],
uid_shift_socket_pair[1], uid_shift_socket_pair[1],
unified_cgroup_hierarchy_socket_pair[1], unified_cgroup_hierarchy_socket_pair[1],
fds); fds,
netns_fd);
if (r < 0) if (r < 0)
_exit(EXIT_FAILURE); _exit(EXIT_FAILURE);