From: Ian Kelling Date: Mon, 21 Aug 2017 05:08:39 +0000 (-0700) Subject: add resolvconf mount namespace X-Git-Url: https://iankelling.org/git/?a=commitdiff_plain;h=8448af56da3cdaf6e50b075b322031e8edeb9760;p=newns add resolvconf mount namespace --- diff --git a/newns b/newns index 713c29d..e4d1f86 100755 --- a/newns +++ b/newns @@ -40,12 +40,12 @@ usage() { usage: ${0##*/} [OPTS] start|stop NS_NAME Nat a network namespace. systemd friendly -Also creates a mount namespace with a cloned /etc/resolv.conf. +Also creates a mount namespace with a cloned /run/resolvconf. -c, --create Create a named network namespace. When running from the same network namespace as pid 1, this is set automatically. - This is the case when running outside a systemd created - private network. + A systemd created private network is in a network namespace + different than pid 1. -n NETWORK x.x.x /24 private network to use. If not specified, uses the first one starting at 10.173.1 -h, --help Show this help and exit. @@ -87,6 +87,8 @@ calls resolvconf, this doesn't help much. What we actually want to do is copy /run/resolvconf somehwere then bind mount it on top of /run/resolvconf. +Note: for debugging, adding set -x is a pretty good option. + Please email me if you have a patches, bugs, feedback, or republish this somewhere else: Ian Kelling . EOF @@ -149,12 +151,17 @@ fi ipd() { ip -n default "$@"; } if $create; then + # run ip in the network namespace ipnn() { ip -n $nn "$@"; } else # we are already in the network namespace and it's unnamed. + # run ip in the network namespace ipnn() { ip "$@"; } fi +# default network namespace exec dexec() { ip netns exec default "$@"; } +# mount namespace exec +mexec() { /usr/bin/nsenter --mount=/root/mount_namespaces/$nn "$@"; } # background: head -n1 is defensive. Not sure if there is some weird feature @@ -211,8 +218,9 @@ start() { # namespace is marked on mounts within the namespace. Here, we # specify that we want mount changes propagated to us, but not # back. - unshare --propagation slave --mount=/root/mount_namespaces/$nn + unshare --propagation slave --mount=/root/mount_namespaces/$nn /bin/true fi + #### end mount namespace setup #### @@ -223,6 +231,11 @@ start() { echo 1 | dexec dd of=/proc/sys/net/ipv4/ip_forward 2>/dev/null + # docker helpfully changes the default FORWARD to drop... + if ! dexec iptables -C FORWARD -i $v0 -j ACCEPT &>/dev/null; then + dexec iptables -A FORWARD -i $v0 -j ACCEPT + fi + _errcatch_cleanup=stop ipnn link add $v0 type veth peer name $v1 ipnn link set $v0 netns default @@ -233,6 +246,33 @@ start() { ipnn link set $v1 up ipnn route add default via $network.1 + ###### begin setup resolvconf + resolv_copy=/root/resolvconf-$nn + + # this condition should never happen, just coding defensively + if mexec mountpoint /run/resolvconf &>/dev/null; then + mexec umount /run/resolvconf + fi + cp -aT /run/resolvconf $resolv_copy + if ! mexec mount -o bind $resolv_copy /run/resolvconf; then + echo "error: resolv-conf bindmount failed" + exit 1 + fi + # if running dnsmasq, we have 127.0.0.1 for dns, but it can't listen on the loopback + # in the network namespace, so adjust the address. + if mexec [ -s /run/resolvconf/interface/lo.dnsmasq ]; then + mexec sed --follow-symlinks -i "s/nameserver 127\..*/nameserver $network.1/" /run/resolvconf/interface/lo.dnsmasq + mexec resolvconf -u + fi + # background: if we did this in openvpn's resolv-conf script, we could guard it in + # if capsh --print|grep '\bcap_sys_admin\b' &>/dev/null + # and we could get $nn by + # config_basename=${config%%.*} + # config_basename=${config_basename##*/} + # but dnsmasq forces us to do it earlier. + ###### end setup resolvconf + + } stop() { @@ -244,9 +284,16 @@ stop() { if ! $existing; then if nat -C &>/dev/null; then nat -D; fi fi + dexec iptables -D FORWARD -i $v0 -j ACCEPT ||: if $create; then ip netns del $nn fi + + # not sure this is necessary since we are tearing down the mount namespace + if mexec mountpoint /run/resolvconf &>/dev/null; then + mexec umount /run/resolvconf + fi + if mountpoint /root/mount_namespaces/$nn >/dev/null; then umount /root/mount_namespaces/$nn fi