Hi Matteo,
On Mon, Jul 10, 2017 at 02:08:31PM +0200, Matteo Croce wrote:
> I noticed that your patch still leaves an uncovered scenario, the one where
> the
> namespace name is "." or "..".
> Calling 'ip netns del ..' will remove /var/run which is a symlink to /run on
> most systems causing some daemons, eg. dbus, to fail.
Oh, indeed. My patch even checks the name for 'ip netns add' only!
> ip netns doesn't validate input, allowing creation and deletion of files
> relatives to /var/run/netns.
> This patch denies creation or deletion of namespaces with names contaning
> "/" or that matches exactly "." or "..".
You might want to have a look at --scissors option to git-am for a more
elegant way of sending a reply with attached patch.
[...]
> int do_netns(int argc, char **argv)
> {
> netns_nsid_socket_init();
> @@ -775,6 +780,11 @@ int do_netns(int argc, char **argv)
> return netns_list(0, NULL);
> }
>
> + if (argc > 1 && invalid_name(argv[1])) {
> + fprintf(stderr, "Invalid netns name \"%s\"\n", argv[1]);
> + exit(-1);
> + }
Maybe worth noting, this assumes argv[1] will be used for the netns name
which doesn't hold for 'ip netns identify' command. It doesn't matter
though, since netns_identify() enforces the parameter to be either
"self" or a decimal number. Yet, in future a new subcommand might be
added which requires this check to be refactored.
Thanks, Phil
