cmd/snap-confine: discard stale mount namespaces #4324
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
zyga
commented
Nov 29, 2017
| } | ||
|
|
||
| bool sc_should_populate_ns_group(struct sc_ns_group *group) | ||
| bool sc_should_populate_ns_group(struct sc_ns_group * group) |
There was a problem hiding this comment.
Oddly this is coming out of my machine's make fmt. If indent changed rules again I will call for a flag day and propose that we move to clang-format that at least has a very readable and sane output without 80 column constraint.
There was a problem hiding this comment.
/me happens to like the 80 column constraint. ;)
jdstrand
suggested changes
Nov 29, 2017
|
FYI This is indent being inconsistent with itself. :/ |
|
I've implemented the version that calls setns only once now. I'll close this PR and open a 2nd one when tests are happy. |
This patch enables snap-confine to discard stale mount namespaces. The code already contained to logic to detect a stale namespace. The patch introduces an additional check. Once we know of a stale namespace we check if it would be safe to discard it by looking at the processes that inhabit it. This can be done reliably by enumerating the freezer group. If we find any process we consider it unsafe for the mount namespace to be discarded but we log a diagnostic message that system administrators can see (it can be an important security fact that a particular snap is using an older revision of the base snap). The code is made a little bit more generic so that we can also filter by user identifier. This is likely to be used by the upcoming per-user mount namespace feature. The apparmor profile is extended slightly to be able to read the cgroup.procs file and to unmount existing namespaces. That last thing is a bit of a magic / broken rule as apparmor has some issues that we don't fully understand whenever setns is called. < jjohansen> uh, setns is a known problem, double setns doesn't change that < jjohansen> hey zyga-ubuntu, setns won't necessarily break everything dependent on several things. Partly to due with how mounts are shared or whether they are cloned .. Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
zyga
force-pushed
the
fix/discard-stale-base-snap
branch
from
b9c547d
to
7824fb1
Compare
|
I'm closing this PR in favour of the v2 approach. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This patch enables snap-confine to discard stale mount namespaces. The
code already contained to logic to detect a stale namespace. The patch
introduces an additional check. Once we know of a stale namespace we
check if it would be safe to discard it by looking at the processes that
inhabit it. This can be done reliably by enumerating the freezer group.
If we find any process we consider it unsafe for the mount namespace to
be discarded but we log a diagnostic message that system administrators
can see (it can be an important security fact that a particular snap is
using an older revision of the base snap).
The code is made a little bit more generic so that we can also filter by
user identifier. This is likely to be used by the upcoming per-user
mount namespace feature.
The apparmor profile is extended slightly to be able to read the
cgroup.procs file and to unmount existing namespaces. That last thing is
a bit of a magic / broken rule as apparmor has some issues that we don't
fully understand whenever setns is called.
< jjohansen> uh, setns is a known problem, double setns doesn't
change that
< jjohansen> hey zyga-ubuntu, setns won't necessarily break
everything dependent on several things. Partly to due with how mounts
are shared or whether they are cloned ..
Signed-off-by: Zygmunt Krynicki zygmunt.krynicki@canonical.com