Re: [libvirt] [PATCH 1 of 4] [LXC] Detect support for NETNS in lxc driver initialization
Dan Smith wrote:
DL> The CLONE_NEWNET will fail if the network namespace is not
DL> compiled in. I understand this check but it looks like a little
DL> random. You are not 100% sure this clone has failed because the
DL> network namespace is not supported. That can be another subsystem
DL> or namespace which has failed during the initialization of the
DL> namespaces.
The check is performed twice, once with the basic set of flags and
again with CLONE_NEWNET. If the first check fails, we assume no LXC
support (as we did before). If the second fails, we assume LXC but no
NETNS. Is there something else I'm missing here?
DL> Why don't you simply check the presence of the 'netns' process ?
That seems like a valid way as well, although we already do our
feature checks by testing the clone. Also, by doing it this way, we
have a better confirmation that an actual clone(CLONE_NEWNET) will
work, IMHO.
You are not doing clone(CLONE_NEWNET) in this code.
You call
clone(CLONE_NEWPID|CLONE_NEWNS|CLONE_NEWUTS|CLONE_NEWUSER|CLONE_NEWIPC|SIGCHLD|CLONE_NEWNET)
When this call fails, you 'assume' netns is not compiled in.
I agree the clone should have returned ENOSYS in this case, but it
returns EINVAL and that do not means 'netns in not active'.
If you look at the processes, you have a kthread called '[netns]', which
indicates the network namespaces are actives in the kernel and this is
not an assumption.
DL> Concerning iproute2, I think this is the work of the installer
to
DL> check the dependencies, eg. the libvirt rpm depends on
DL> iproute2-x.y.z version rpm.
Agreed, and I'm sure it will. Note DV's second comment here:
https://www.redhat.com/archives/libvir-list/2008-June/msg00232.html
In your code, you launch the ip command and if it fails with a
particular exit code, you 'assume' netns is not supported. Another
assumption ... IMHO you should rely on the package dependencies/command
version. Or if you absolutely want to detect that at startup, perhaps
doing "ip link help | grep netns" is more secure :)