validate: Check that the given namespace path is a symlink #1221
Conversation
|
LGTM |
| return false, nil | ||
| } | ||
|
|
||
| return true, nil |
There was a problem hiding this comment.
This should be written as all one-line (no if statement):
return fi.Mode()&os.ModeSymlink == os.ModeSymlink, nil| // it is not the host namespace. | ||
| return nil | ||
| } | ||
|
|
||
| // readlink on the path provided in the struct | ||
| destOfContainer, err := os.Readlink(path) |
There was a problem hiding this comment.
I'm confused what benefit this new code has -- this will always error out if path is not a symlink.
There was a problem hiding this comment.
@cyphar If path is not symlink, i.e. a persistent namespace, it will not error out.
It will only error out if path is a symlink and point to the same namespace as /proc/self/ns/net, which is considered to be the host namespace.
In other words, this routine will error out if path is not pointing at a persistent namespace and if it's a symbolic link pointing at the host namespace.
There was a problem hiding this comment.
My point is that readlink will always error out if you try to read a non-symlink:
% touch /tmp/uts-ns
% sudo unshare --uts=/tmp/uts-ns hostname FOO
% sudo readlink /tmp/uts-ns
% echo $?
1
EDIT: Oops, I though you were returning an error when it wasn't a symlink. My bad.
There was a problem hiding this comment.
Ah sorry, I just re-read your code and I understand what you mean! Personally I'd prefer if you did something like check that the *LinkError from Readlink is EINVAL. But this works.
ebe53db to
743ab58
Compare
When checking if the provided networking namespace is the host one or not, we should first check if it's a symbolic link or not as in some cases we can use persistent networking namespace under e.g. /var/run/netns/. Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
743ab58 to
f19aa2d
Compare
|
LGTM. Sorry about that confusion. 😸 |
|
LGTM |
When checking if the provided networking namespace is the host
one or not, we should first check if it's a symbolic link or not
as in some cases we can use persistent networking namespace under
e.g. /var/run/netns/.
Signed-off-by: Samuel Ortiz sameo@linux.intel.com