On Wed, 2025-04-30 at 20:07 -0700, Kuniyuki Iwashima wrote:
> From: Jeff Layton <jlay...@kernel.org>
> Date: Wed, 30 Apr 2025 19:59:23 -0700
> > On Wed, 2025-04-30 at 14:29 -0700, Kuniyuki Iwashima wrote:
> > > From: Jeff Layton <jlay...@kernel.org>
> > > Date: Wed, 30 Apr 2025 08:06:54 -0700
> > > > After assigning the inode number to the namespace, use it to create a
> > > > unique name for each netns refcount tracker with the ns.inum value in
> > > > it, and register a symlink to the debugfs file for it.
> > > >
> > > > init_net is registered before the ref_tracker dir is created, so add a
> > > > late_initcall() to register its files and symlinks.
> > > >
> > > > Signed-off-by: Jeff Layton <jlay...@kernel.org>
> > > > ---
> > > > net/core/net_namespace.c | 28 +++++++++++++++++++++++++++-
> > > > 1 file changed, 27 insertions(+), 1 deletion(-)
> > > >
> > > > diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
> > > > index
> > > > 008de9675ea98fa8c18628b2f1c3aee7f3ebc9c6..6cbc8eabb8e56c847fc34fa8ec9994e8b275b0af
> > > > 100644
> > > > --- a/net/core/net_namespace.c
> > > > +++ b/net/core/net_namespace.c
> > > > @@ -763,12 +763,38 @@ struct net *get_net_ns_by_pid(pid_t pid)
> > > > }
> > > > EXPORT_SYMBOL_GPL(get_net_ns_by_pid);
> > > >
> > > > +#ifdef CONFIG_NET_NS_REFCNT_TRACKER
> > > > +static void net_ns_net_debugfs(struct net *net)
> > > > +{
> > > > + ref_tracker_dir_symlink(&net->refcnt_tracker,
> > > > "netns-%u-refcnt", net->ns.inum);
> > > > + ref_tracker_dir_symlink(&net->notrefcnt_tracker,
> > > > "netns-%u-notrefcnt", net->ns.inum);
> > >
> > > Could you use net->net_cookie ?
> > >
> > > net->ns.inum is always 1 when CONFIG_PROC_FS=n.
> >
> > My main use-case for this is to be able to match the inode number in
> > the /proc/<pid>/ns/net symlink with the correct ref_tracker debugfs
> > file. Is there a way to use the net_cookie to make that association?
>
> It's roundabout, but net_cookie can be retrieved by creating a
> random socket in the netns and calling setsockopt(SO_NETNS_COOKIE).
>
> Ido proposed a handy ip-netns subcommand here, and I guess it will
> be implemented soon(?)
> https://lore.kernel.org/netdev/1d99d7ccfc3a7a18840948ab6ba1c0b5fad90901.ca...@fejes.dev/
For the cases where I was looking at netns leaks, there were no more
processes in the container, so there was no way to enter the container
and spawn a socket at that point.
The point of the symlinks is to have a way to easily identify what
you're tracking. NAME_MAX is 255. We could do something like this
instead:
snprintf(..., "netns-%u-%llx-refcnt", net->ns.inum, net->net_cookie);
Obviously the inums would all be 1 when PROC_FS=n, but the cookies
would be unique. Would that work?
>
> >
> > If there isn't, and ns.inum is always 1 with procfs is disabled, we
> > could just skip adding the symlink when CONFIG_PROC_FS=n.
--
Jeff Layton <jlay...@kernel.org>
