passt/pasta.h

/* SPDX-License-Identifier: AGPL-3.0-or-later
 * Copyright (c) 2021 Red Hat GmbH
 * Author: Stefano Brivio <sbrivio@redhat.com>
 */

#ifndef PASTA_H
#define PASTA_H

void pasta_open_ns(struct ctx *c, const char *netns);
void pasta_start_ns(struct ctx *c, int argc, char *argv[]);
void pasta_ns_conf(struct ctx *c);
void pasta_child_handler(int signal);
int pasta_netns_quit_init(struct ctx *c);
void pasta_netns_quit_handler(struct ctx *c, int inotify_fd);

#endif /* PASTA_H */
LICENSES: Add license text files, add missing notices, fix SPDX tags SPDX tags don't replace license files. Some notices were missing and some tags were not according to the SPDX specification, too. Now reuse --lint from the REUSE tool (https://reuse.software/) passes. Reported-by: Martin Hauke <mardnh@gmx.de> Signed-off-by: Stefano Brivio <sbrivio@redhat.com> 2021-10-19 12:43:28 +02:00			`/* SPDX-License-Identifier: AGPL-3.0-or-later`
			`* Copyright (c) 2021 Red Hat GmbH`
			`* Author: Stefano Brivio <sbrivio@redhat.com>`
			`*/`

treewide: Add include guards ...at the moment, just for consistency with packet.h, icmp.h, tcp.h and udp.h. Signed-off-by: Stefano Brivio <sbrivio@redhat.com> 2022-03-26 00:05:31 +01:00			`#ifndef PASTA_H`
			`#define PASTA_H`

Handle userns isolation and dropping root at the same time passt/pasta can interact with user namespaces in a number of ways: 1) With --netns-only we'll remain in our original user namespace 2) With --userns or a PID option to pasta we'll join either the given user namespace or that of the PID 3) When pasta spawns a shell or command we'll start a new user namespace for the command and then join it 4) With passt we'll create a new user namespace when we sandbox() ourself However (3) and (4) turn out to have essentially the same effect. In both cases we create one new user namespace. The spawned command starts there, and passt/pasta itself will live there from sandbox() onwards. Because of this, we can simplify user namespace handling by moving the userns handling earlier, to the same point we drop root in the original namespace. Extend the drop_user() function to isolate_user() which does both. After switching UID and GID in the original userns, isolate_user() will either join or create the userns we require. When we spawn a command with pasta_start_ns()/pasta_setup_ns() we no longer need to create a userns, because we're already made one. sandbox() likewise no longer needs to create (or join) an userns because we're already in the one we need. We no longer need c->pasta_userns_fd, since the fd is only used locally in isolate_user(). Likewise we can replace c->netns_only with a local in conf(), since it's not used outside there. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> 2022-09-12 14:24:07 +02:00			`void pasta_open_ns(struct ctx c, const char netns);`
Allow pasta to take a command to execute When not given an existing PID or network namspace to attach to, pasta spawns a shell. Most commands which can spawn a shell in an altered environment can also run other commands in that same environment, which can be useful in automation. Allow pasta to do the same thing; it can be given an arbitrary command to run in the network and user namespace which pasta creates. If neither a command nor an existing PID or netns to attach to is given, continue to spawn a default shell, as before. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> 2022-08-26 06:58:39 +02:00			`void pasta_start_ns(struct ctx c, int argc, char argv[]);`
pasta: Push pasta.h header ...I forgot to add this earlier. Signed-off-by: Stefano Brivio <sbrivio@redhat.com> 2021-10-14 13:40:53 +02:00			`void pasta_ns_conf(struct ctx *c);`
			`void pasta_child_handler(int signal);`
pasta: By default, quit if filesystem-bound net namespace goes away This should be convenient for users managing filesystem-bound network namespaces: monitor the base directory of the namespace and exit if the namespace given as PATH or NAME target is deleted. We can't add an inotify watch directly on the namespace directory, that won't work with nsfs. Add an option to disable this behaviour, --no-netns-quit. Signed-off-by: Stefano Brivio <sbrivio@redhat.com> 2022-02-18 16:12:11 +01:00			`int pasta_netns_quit_init(struct ctx *c);`
			`void pasta_netns_quit_handler(struct ctx *c, int inotify_fd);`
treewide: Add include guards ...at the moment, just for consistency with packet.h, icmp.h, tcp.h and udp.h. Signed-off-by: Stefano Brivio <sbrivio@redhat.com> 2022-03-26 00:05:31 +01:00
			`#endif /* PASTA_H */`