Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   David Laight <David.Laight@ACULAB.COM>
To:     "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "netdev@vger.kernel.org" <netdev@vger.kernel.org>
CC:     "Eric W. Biederman" <ebiederm@xmission.com>,
        "Serge E. Hallyn" <serge@hallyn.com>,
        Linus Torvalds <torvalds@linux-foundation.org>
Subject: re: [PATCH 3/4] proc: Point /proc/net at /proc/thread-self/net
 instead of /proc/self/net
Thread-Topic: re: [PATCH 3/4] proc: Point /proc/net at /proc/thread-self/net
 instead of /proc/self/net
Thread-Index: AdjUFaAzwFjoFpF4RWSGA65kFT23EA==
Date:   Thu, 29 Sep 2022 15:22:10 +0000
Message-ID: <dacfc18d6667421d97127451eafe4f29@AcuMS.aculab.com>
Accept-Language: en-GB, en-US
MIME-Version: 1.0
Content-Language: en-US
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8BIT
Precedence: bulk

I've just bumped into (the lack of) this change (from aug 2014):

> In oddball cases where the thread has a different network namespace
> than the primary thread group leader or more likely in cases where
> the thread remains and the thread group leader has exited this
> ensures that /proc/net continues to work.

> -	proc_symlink("net", NULL, "self/net");
> +	proc_symlink("net", NULL, "thread-self/net");

This was applied and then reverted by Linus (I can't find anything
in the LKML archive) - see git show 155134fef - because of
issues with apparmor and dhclient.

In my case we have an application that is started in one
network namespace (where most of what it needs to do exists)
but needs one thread to revert to the 'init' namespace in
order to accept TCP connections from applications.

The thread that reverts is the main thread.
Until a change made in the last 6 months it actually worked.
(I'm using 5.10 LTS kernels so I'm not sure when.)
Then a fix was made to correctly update the mounts when the
namespace changed - and it suddenly stopped working.

So the 'oddball' case of different threads being in different
namespaces and then accessing /proc/net (because that is what
the code always did before being changed to run in a namespace)
has happened to a real application.

Fortunately it happened in testing and the application could
be changed.

(I was looking at the kernel sources to propose the change
that got reverted!)

	David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)