| Message ID | 2ef2150d-7149-cf39-0ea8-78edfc2c8d92@virtuozzo.com |
|---|---|
| State | Not Applicable, archived |
| Delegated to: | David Miller |
| Headers | show |
| Series | [Q] iptables: child user_ns: Fatal: can't open lock file /run/xtables.lock: Permission denied | expand |
On 09.02.2018 16:34, Kirill Tkhai wrote: > Hi, > > after commit 80d8bfaac9e2430d710084a10ec78e68bd61e6ec "iptables: insist that the lock is held." > it became impossible restore to configure iptables from child user namespace: > > kirill@:~/criu$ unshare -U -m -p -f -n --map-root-user --mount-proc > root@:~/criu# iptables -A INPUT -s 1.2.3.4 -j DROP > Fatal: can't open lock file /run/xtables.lock: Permission denied > > iptables running inside init user ns/init net ns create the file with 0600, and others > are not able to open it. > > It seems a good solution could be to use per net ns file to flock it, > and this would provide more scalability. But the problem is there is > not good one to choose. It could be someone like /proc/self/net/netfilter, > but /proc fs is made in the way, that /proc/X/net/netfilter and /proc/Y/net/netfilter > have different inodes, despite X and Y refer to the same net ns. It seems, > the only good candidate is /proc/self/ns/net, but it's too generic file > to lock it (it may be interesting not only for iptables). Not sure, we can use it. > > So, it looks like the solution may be to create the file with 0666 mode by default. > This does not lose security, as it's only iptables agreement, and evil person > could just compile iptables without this file lock check. How do you think about all this? > > diff --git a/iptables/xshared.c b/iptables/xshared.c > index 06db72d4..fbbe9495 100644 > --- a/iptables/xshared.c > +++ b/iptables/xshared.c > @@ -254,7 +254,7 @@ static int xtables_lock(int wait, struct timeval *wait_interval) > time_left.tv_sec = wait; > time_left.tv_usec = 0; > > - fd = open(XT_LOCK_NAME, O_CREAT, 0600); > + fd = open(XT_LOCK_NAME, O_CREAT, 0666); > if (fd < 0) { > fprintf(stderr, "Fatal: can't open lock file %s: %s\n", > XT_LOCK_NAME, strerror(errno)); > > Kirill Hm. I've tried "/proc/self/net/netfilter", and found the inodes are identical. But for some strange reasons it's possible to take flock() twice on it. So we can't use it till this is not fixed. #include <errno.h> #include <stdio.h> #include <stdlib.h> #include <sys/file.h> #include <fcntl.h> #include <sys/types.h> #include <sys/stat.h> #include <unistd.h> int lock_file() { struct stat buf; int fd; fd = open("/proc/self/net/netfilter", O_RDONLY, 0600); if (fd < 0) { perror("Fatal: can't open lock file\n"); return 1; } if (flock(fd, LOCK_EX) == 0) printf("%d: OK\n", getpid()); else perror("FAIL\n"); return 0; } int main() { if (fork() == -1) { perror("fork"); exit(1); } lock_file(); sleep(100); return 0; }
diff --git a/iptables/xshared.c b/iptables/xshared.c index 06db72d4..fbbe9495 100644 --- a/iptables/xshared.c +++ b/iptables/xshared.c @@ -254,7 +254,7 @@ static int xtables_lock(int wait, struct timeval *wait_interval) time_left.tv_sec = wait; time_left.tv_usec = 0; - fd = open(XT_LOCK_NAME, O_CREAT, 0600); + fd = open(XT_LOCK_NAME, O_CREAT, 0666); if (fd < 0) { fprintf(stderr, "Fatal: can't open lock file %s: %s\n", XT_LOCK_NAME, strerror(errno));