mirror of
https://passt.top/passt
synced 2024-06-30 15:02:40 +00:00
d8921dafe5
Adapted from a patch by Paul Holzinger: when pasta spawns a command,
operating without a pre-existing user and network namespace, it needs
to wait for the tap device to be configured and its handler ready,
before the command is actually executed.
Otherwise, something like:
pasta --config-net nslookup passt.top
usually fails as the nslookup command is issued before the network
interface is ready.
We can't adopt a simpler approach based on SIGSTOP and SIGCONT here:
the child runs in a separate PID namespace, so it can't send SIGSTOP
to itself as the kernel sees the child as init process and blocks
the delivery of the signal.
We could send SIGSTOP from the parent, but this wouldn't avoid the
possible condition where the child isn't ready to wait for it when
the parent sends it, also raised by Paul -- and SIGSTOP can't be
blocked, so it can never be pending.
Use SIGUSR1 instead: mask it before clone(), so that the child starts
with it blocked, and can safely wait for it. Once the parent is
ready, it sends SIGUSR1 to the child. If SIGUSR1 is sent before the
child is waiting for it, the kernel will queue it for us, because
it's blocked.
Reported-by: Paul Holzinger <pholzing@redhat.com>
Fixes: 1392bc5ca0 ("Allow pasta to take a command to execute")
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
20 lines
536 B
C
20 lines
536 B
C
/* SPDX-License-Identifier: AGPL-3.0-or-later
|
|
* Copyright (c) 2021 Red Hat GmbH
|
|
* Author: Stefano Brivio <sbrivio@redhat.com>
|
|
*/
|
|
|
|
#ifndef PASTA_H
|
|
#define PASTA_H
|
|
|
|
extern int pasta_child_pid;
|
|
|
|
void pasta_open_ns(struct ctx *c, const char *netns);
|
|
void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid,
|
|
int argc, char *argv[]);
|
|
void pasta_ns_conf(struct ctx *c);
|
|
void pasta_child_handler(int signal);
|
|
int pasta_netns_quit_init(struct ctx *c);
|
|
void pasta_netns_quit_handler(struct ctx *c, int inotify_fd);
|
|
|
|
#endif /* PASTA_H */
|