[PATCH v2 0/2] pasta: Do not configure ID mappings when invoked with --netns-only

older
[PATCH 0/2] Allow users to give...

Dwayne B. Bent

22 Jul 2026 22 Jul '26

5:32 p.m.

Patch revised based on comments: 1. Reordered test and code commits to not break bisections. 2. Added `Link:` lines to commit messages. Otherwise code and test are the same. Thanks. Dwayne B. Bent (2): pasta: Do not configure ID mappings when invoked with --netns-only pasta: Regression test for bug 216 conf.c | 2 +- pasta.c | 24 ++++++++++++++---------- pasta.h | 3 ++- test/pasta_options/netns_only | 19 +++++++++++++++++++ test/run | 1 + 5 files changed, 37 insertions(+), 12 deletions(-) create mode 100644 test/pasta_options/netns_only -- 2.55.0

Show replies by date

Dwayne B. Bent

22 Jul 22 Jul

5:32 p.m.

New subject: [PATCH v2 1/2] pasta: Do not configure ID mappings when invoked with --netns-only

Add a `bool` argument `config_idmaps` to `pasta_start_ns()` that guards the logic to configure user and group ID mappings. It is set to `false` when `netns_only` is `true`. Fixes bug 216. Link: https://bugs.passt.top/show_bug.cgi?id=216 Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Dwayne B. Bent --- conf.c | 2 +- pasta.c | 24 ++++++++++++++---------- pasta.h | 3 ++- 3 files changed, 17 insertions(+), 12 deletions(-) diff --git a/conf.c b/conf.c index 0fcba5c..2223604 100644 --- a/conf.c +++ b/conf.c @@ -1945,7 +1945,7 @@ void conf(struct ctx *c, int argc, char **argv) if (*netns) { pasta_open_ns(c, netns); } else { - pasta_start_ns(c, uid, gid, + pasta_start_ns(c, uid, gid, !netns_only, argc - optind, argv + optind); } } diff --git a/pasta.c b/pasta.c index 4e7ee54..5aa56b7 100644 --- a/pasta.c +++ b/pasta.c @@ -236,10 +236,11 @@ static int pasta_spawn_cmd(void *arg) * @c: Execution context * @uid: UID we're running as in the init namespace * @gid: GID we're running as in the init namespace + * @config_idmaps: Whether to configure user mappings * @argc: Number of arguments for spawned command * @argv: Command to spawn and arguments */ -void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid, +void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid, bool config_idmaps, int argc, char *argv[]) { char ns_fn_stack[NS_FN_STACK_SIZE] @@ -249,7 +250,6 @@ void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid, .argv = argv, .c = c, }; - char uidmap[BUFSIZ], gidmap[BUFSIZ]; char *sh_argv[] = { NULL, NULL }; char sh_arg0[PATH_MAX + 1]; sigset_t set; @@ -259,16 +259,20 @@ void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid, c->quiet = 1; /* Configure user and group mappings */ - if (snprintf_check(uidmap, BUFSIZ, "0 %u 1", uid)) - die_perror("Can't build uidmap"); + if (config_idmaps) { + char uidmap[BUFSIZ], gidmap[BUFSIZ]; - if (snprintf_check(gidmap, BUFSIZ, "0 %u 1", gid)) - die_perror("Can't build gidmap"); + if (snprintf_check(uidmap, BUFSIZ, "0 %u 1", uid)) + die_perror("Can't build uidmap"); - if (write_file("/proc/self/uid_map", uidmap) || - write_file("/proc/self/setgroups", "deny") || - write_file("/proc/self/gid_map", gidmap)) { - warn("Couldn't configure user mappings"); + if (snprintf_check(gidmap, BUFSIZ, "0 %u 1", gid)) + die_perror("Can't build gidmap"); + + if (write_file("/proc/self/uid_map", uidmap) || + write_file("/proc/self/setgroups", "deny") || + write_file("/proc/self/gid_map", gidmap)) { + warn("Couldn't configure user mappings"); + } } if (argc == 0) { diff --git a/pasta.h b/pasta.h index 07e04b3..edd7747 100644 --- a/pasta.h +++ b/pasta.h @@ -6,12 +6,13 @@ #ifndef PASTA_H #define PASTA_H +#include #include extern int pasta_child_pid; void pasta_open_ns(struct ctx *c, const char *netns); -void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid, +void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid, bool config_idmaps, int argc, char *argv[]); void pasta_ns_conf(struct ctx *c); void pasta_child_handler(int signal); -- 2.55.0

Dwayne B. Bent

5:32 p.m.

New subject: [PATCH v2 2/2] pasta: Regression test for bug 216

Adds a test that asserts that when pasta is invoked via `unshare -r` in standalone mode with `--netns-only` it does not print any warnings, and the command executes successfully. Link: https://bugs.passt.top/show_bug.cgi?id=216 Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Dwayne B. Bent --- test/pasta_options/netns_only | 19 +++++++++++++++++++ test/run | 1 + 2 files changed, 20 insertions(+) create mode 100644 test/pasta_options/netns_only diff --git a/test/pasta_options/netns_only b/test/pasta_options/netns_only new file mode 100644 index 0000000..197ed44 --- /dev/null +++ b/test/pasta_options/netns_only @@ -0,0 +1,19 @@ +# SPDX-License-Identifier: GPL-2.0-or-later +# +# PASST - Plug A Simple Socket Transport +# for qemu/UNIX domain socket mode +# +# PASTA - Pack A Subtle Tap Abstraction +# for network namespace/tap device mode +# +# test/pasta_options/netns_only - Check --netns-only handling + +htools unshare grep + +test --netns-only skips id mapping configuration +set OUT __STATEDIR__/netns-only.out +set ERR __STATEDIR__/netns-only.err + +passt unshare -r -- ./pasta -q --netns-only -- echo TEST > __OUT__ 2> __ERR__ +check grep -qx TEST __OUT__ +check [ ! -s __ERR__ ] diff --git a/test/run b/test/run index f858e55..c4073cc 100755 --- a/test/run +++ b/test/run @@ -85,6 +85,7 @@ run() { setup pasta_options test pasta_options/log_to_file + test pasta_options/netns_only teardown pasta_options setup build -- 2.55.0

David Gibson

23 Jul 23 Jul

5:44 a.m.

New subject: [PATCH v2 1/2] pasta: Do not configure ID mappings when invoked with --netns-only

On Wed, Jul 22, 2026 at 11:32:41AM -0400, Dwayne B. Bent wrote:

...

Add a `bool` argument `config_idmaps` to `pasta_start_ns()` that guards the logic to configure user and group ID mappings. It is set to `false` when `netns_only` is `true`. Fixes bug 216.

Link: https://bugs.passt.top/show_bug.cgi?id=216

Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Dwayne B. Bent

Reviewed-by: David Gibson

...

--- conf.c | 2 +- pasta.c | 24 ++++++++++++++---------- pasta.h | 3 ++- 3 files changed, 17 insertions(+), 12 deletions(-)

diff --git a/conf.c b/conf.c index 0fcba5c..2223604 100644 --- a/conf.c +++ b/conf.c @@ -1945,7 +1945,7 @@ void conf(struct ctx *c, int argc, char **argv) if (*netns) { pasta_open_ns(c, netns); } else { - pasta_start_ns(c, uid, gid, + pasta_start_ns(c, uid, gid, !netns_only, argc - optind, argv + optind); } } diff --git a/pasta.c b/pasta.c index 4e7ee54..5aa56b7 100644 --- a/pasta.c +++ b/pasta.c @@ -236,10 +236,11 @@ static int pasta_spawn_cmd(void *arg) * @c: Execution context * @uid: UID we're running as in the init namespace * @gid: GID we're running as in the init namespace + * @config_idmaps: Whether to configure user mappings * @argc: Number of arguments for spawned command * @argv: Command to spawn and arguments */ -void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid, +void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid, bool config_idmaps, int argc, char *argv[]) { char ns_fn_stack[NS_FN_STACK_SIZE] @@ -249,7 +250,6 @@ void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid, .argv = argv, .c = c, }; - char uidmap[BUFSIZ], gidmap[BUFSIZ]; char *sh_argv[] = { NULL, NULL }; char sh_arg0[PATH_MAX + 1]; sigset_t set; @@ -259,16 +259,20 @@ void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid, c->quiet = 1;

/* Configure user and group mappings */ - if (snprintf_check(uidmap, BUFSIZ, "0 %u 1", uid)) - die_perror("Can't build uidmap"); + if (config_idmaps) { + char uidmap[BUFSIZ], gidmap[BUFSIZ];

- if (snprintf_check(gidmap, BUFSIZ, "0 %u 1", gid)) - die_perror("Can't build gidmap"); + if (snprintf_check(uidmap, BUFSIZ, "0 %u 1", uid)) + die_perror("Can't build uidmap");

- if (write_file("/proc/self/uid_map", uidmap) || - write_file("/proc/self/setgroups", "deny") || - write_file("/proc/self/gid_map", gidmap)) { - warn("Couldn't configure user mappings"); + if (snprintf_check(gidmap, BUFSIZ, "0 %u 1", gid)) + die_perror("Can't build gidmap"); + + if (write_file("/proc/self/uid_map", uidmap) || + write_file("/proc/self/setgroups", "deny") || + write_file("/proc/self/gid_map", gidmap)) { + warn("Couldn't configure user mappings"); + } }

if (argc == 0) { diff --git a/pasta.h b/pasta.h index 07e04b3..edd7747 100644 --- a/pasta.h +++ b/pasta.h @@ -6,12 +6,13 @@ #ifndef PASTA_H #define PASTA_H

+#include #include

extern int pasta_child_pid;

void pasta_open_ns(struct ctx *c, const char *netns); -void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid, +void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid, bool config_idmaps, int argc, char *argv[]); void pasta_ns_conf(struct ctx *c); void pasta_child_handler(int signal); -- 2.55.0

-- David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson

David Gibson

5:45 a.m.

New subject: [PATCH v2 2/2] pasta: Regression test for bug 216

On Wed, Jul 22, 2026 at 11:32:42AM -0400, Dwayne B. Bent wrote:

...

Adds a test that asserts that when pasta is invoked via `unshare -r` in standalone mode with `--netns-only` it does not print any warnings, and the command executes successfully.

Link: https://bugs.passt.top/show_bug.cgi?id=216

Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Dwayne B. Bent

Reviewed-by: David Gibson

...

--- test/pasta_options/netns_only | 19 +++++++++++++++++++ test/run | 1 + 2 files changed, 20 insertions(+) create mode 100644 test/pasta_options/netns_only

diff --git a/test/pasta_options/netns_only b/test/pasta_options/netns_only new file mode 100644 index 0000000..197ed44 --- /dev/null +++ b/test/pasta_options/netns_only @@ -0,0 +1,19 @@ +# SPDX-License-Identifier: GPL-2.0-or-later +# +# PASST - Plug A Simple Socket Transport +# for qemu/UNIX domain socket mode +# +# PASTA - Pack A Subtle Tap Abstraction +# for network namespace/tap device mode +# +# test/pasta_options/netns_only - Check --netns-only handling + +htools unshare grep + +test --netns-only skips id mapping configuration +set OUT __STATEDIR__/netns-only.out +set ERR __STATEDIR__/netns-only.err + +passt unshare -r -- ./pasta -q --netns-only -- echo TEST > __OUT__ 2> __ERR__ +check grep -qx TEST __OUT__ +check [ ! -s __ERR__ ] diff --git a/test/run b/test/run index f858e55..c4073cc 100755 --- a/test/run +++ b/test/run @@ -85,6 +85,7 @@ run() {

setup pasta_options test pasta_options/log_to_file + test pasta_options/netns_only teardown pasta_options

setup build -- 2.55.0

-- David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson

Age (days ago)

Last active (days ago)

List overview

Download

4 comments

2 participants

participants (2)

David Gibson
Dwayne B. Bent