Re: [RFC PATCH iproute2-next 0/5] Persisting of mount namespaces along with network namespaces

["Eric W. Biederman" <ebiederm@xmission.com>]

David Laight <David.Laight@ACULAB.COM> writes:

> From: Eric W. Biederman
>> Sent: 09 October 2023 21:33
>> 
>> Toke Høiland-Jørgensen <toke@redhat.com> writes:
>> 
>> > The 'ip netns' command is used for setting up network namespaces with persistent
>> > named references, and is integrated into various other commands of iproute2 via
>> > the -n switch.
>> >
>> > This is useful both for testing setups and for simple script-based namespacing
>> > but has one drawback: the lack of persistent mounts inside the spawned
>> > namespace. This is particularly apparent when working with BPF programs that use
>> > pinning to bpffs: by default no bpffs is available inside a namespace, and
>> > even if mounting one, that fs disappears as soon as the calling
>> > command exits.
>> 
>> It would be entirely reasonable to copy mounts like /sys/fs/bpf from the
>> original mount namespace into the temporary mount namespace used by
>> "ip netns".
>> 
>> I would call it a bug that "ip netns" doesn't do that already.
>> 
>> I suspect that "ip netns" does copy the mounts from the old sysfs onto
>> the new sysfs is your entire problem.
>
> When I was getting a program to run in multiple network namespaces
> (has sockets in 2 namespaces) I rather expected that netns(net_ns_fd,0)
> would 'magically' change /proc/net to refer to the new namespace.
> I think that could be done in the code that follows the /proc/net
> mountpoint - IIRC something similar is done for /proc/self.

/proc/self/net does follow your current network namespace last I looked.

Of course if you are threaded you may need to look at
/proc/thread-self/net as your network namespace is per thread.

It is also quite evil.  The problem is that having different entries
cached under the same name is a major mess.  Ever since I made that
mistake I have been aiming at designs that don't fight the dcache.

Even in that case I think I limited it to just a entry where
ugliness happens.

> However that would need flags to both setns() and 'ip netns exec'
> since programs will rely on the existing behaviour.

You might want to look again.  

Eric