19.01.2022 01:11, NeilBrown wrote:
On Wed, 19 Jan 2022, Petr Vorel wrote:
Hi all,
this is a test failure posted by Nikita Yushchenko [1]. LTP NFS test nfslock01
looks to be failing on NFS v3:
"not unsharing /var makes AF_UNIX socket for host's rpcbind to become available
inside ltpns. Then, at nfs3 mount time, kernel creates an instance of lockd for
ltpns, and ports for that instance leak to host's rpcbind and overwrite ports
for lockd already active for root namespace. This breaks nfs3 file locking."
"not unsharing /var" .... can this be fixed by simply unsharing /var?
Or is that not simple?
Big picture is - lockd tries to be per-netns, but lockd isn't standalone, it depends on rpcbind, and
rpcbind isn't guaranteed to be per-netns.
One can argue that it is not kernel's job to provide per-netns rpcbind.
Still, the current situation is - by default, doing an nfs mount from within netns B immediately breaks
lockd serving nfs mounts exported from different netns A. "By default" = "as long as nfsmount process
executed in netns B is also in a different mount namespace that has RPCBIND_SOCK_PATHNAME not pointing
to AF_UNIX socket instance owned by rpcbind serving netns A.
Although in LTP's 'nfslock01' test the "non working locking" is reproduced on the same mount that
triggered the breakage, the breakage is not limited to that mount. Since that mount operation in netns
B, any client of nfs exports from netns A will get locking broken - including clients running on
different physical hosts.
I'd say that using AF_UNIX connection from lockd to rpcbind does not play well with per-netns lockd.
Solution to use AF_UNIX connection to rpcbind only for lockd serving root netns, and using AF_INET
otherwise - looks more sane.
On could easily argue that RPCBIND_SOCK_PATHNAME in the kernel should be
changed to "/run/rpcbind.sock".
It may be a better idea to make it configurable per-netns.
Nikita
