From mboxrd@z Thu Jan 1 00:00:00 1970 From: jamal Subject: Re: RFC: netfilter: nf_conntrack: add support for "conntrack zones" Date: Tue, 23 Feb 2010 08:27:03 -0500 Message-ID: <1266931623.3973.643.camel@bigi> References: <4B4F24AC.70105@trash.net> <1263481549.23480.24.camel@bigi> <4B4F3A50.1050400@trash.net> <1263490403.23480.109.camel@bigi> <4B50403A.6010507@trash.net> <1263568754.23480.142.camel@bigi> <1266875729.3673.12.camel@bigi> Reply-To: hadi-fAAogVwAN2Kw5LPnMra/2Q@public.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org Errors-To: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org To: "Eric W. Biederman" Cc: Ben Greear , Linux Netdev List , containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org, Netfilter Development Mailinglist List-Id: containers.vger.kernel.org On Mon, 2010-02-22 at 15:17 -0800, Eric W. Biederman wrote: > What I am thinking is: > > "ip ns route add blah" is: > fd = open("/var/run/netns/"); > sys_setns(fd); /* Like unshare but takes an existing namespace */ > /* Then the rest of the existing ip command */ The other two below make some sense; For the above: Does the point after sys_setns(fd) allow me to do io inside ns ? Can i do open() and get a fd from ns ? > "ip ns list" is: > dfd = open("/var/run/netns", O_DIRECTORY); > getdents(dfd, buf, count); > > "ip ns new " is: > unshare(CLONE_NEWNS); > fd = nsfd(NETNS); > mkdir("/var/run/netns/"); > mount("none", "/var/run/netns/", "ns", 0, fd); > > Using unix domain names means that which namespaces you see is under > control of userspace. Which allows for nested containers (something I > use today), and ultimately container migration. The only problem that i see is events are not as nice. I take it i am going to get something like an inotify when a new namespace is created? > Using genetlink userspace doesn't result in a nestable implementation > unless I introduce yet another namespace, ugh. Is it not just a naming convention that you are dealing with? Example in your scheme above a nested namespace shows up as: /var/run/netns//, no? cheers, jamal