"Connection refused" when using it on Debian Squeeze with 2.6.32 kernel in `unshare -n` about dive HOT 12 CLOSED

How are you trying to use it? Can you connect to the socket manually (i.e. socat - UNIX:/path/to/socket). What command lines do you use to start dived and dive? You can also use strace to see what does exactly dive and dived do.

from dive.

I use Debian myself BTW, with self-compiled kernel although.

from dive.

I've just checked on Debian Squeeze 2.6.32-5.686: works more or less as expected.

from dive.

Here is the info:
root@debian:~# uname -a
Linux debian 2.6.32-5-686 #1 SMP Sun May 6 04:01:19 UTC 2012 i686 GNU/Linux

root@debian:# unshare -n -- dived /var/run/dived.sock -p /var/run/dived.pid -d
root@debian:# dive /var/run/dived.sock ip add
connect: Connection refused

root@debian:~# socat - UNIX:/var/run/dived.sock
2012/11/27 01:41:36 socat[15534] E connect(3, AF=1 "/var/run/dived.sock", 21): Connection refused

------------------------------------------------- straces

------------------------------------------------ dived

root@debian:~# strace unshare -n -- dived /var/run/dived.sock -p /var/run/dived.pid -d
execve("/usr/bin/unshare", ["unshare", "-n", "--", "dived", "/var/run/dived.sock", "-p", "/var/run/dived.pid", "-d"], [/* 14 vars /]) = 0
brk(0) = 0x8db0000
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
mmap2(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb77ae000
access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY) = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=24326, ...}) = 0
mmap2(NULL, 24326, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb77a8000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
open("/lib/i686/cmov/libc.so.6", O_RDONLY) = 3
read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\0n\1\0004\0\0\0"..., 512) = 512
fstat64(3, {st_mode=S_IFREG|0755, st_size=1327556, ...}) = 0
mmap2(NULL, 1337704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7661000
mprotect(0xb77a1000, 4096, PROT_NONE) = 0
mmap2(0xb77a2000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x140) = 0xb77a2000
mmap2(0xb77a5000, 10600, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb77a5000
close(3) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7660000
set_thread_area({entry_number:-1 -> 6, base_addr:0xb76606c0, limit:1048575, seg_32bit:1, contents:0, read_exec_only:0, limit_in_pages:1, seg_not_present:0, useable:1}) = 0
mprotect(0xb77a2000, 8192, PROT_READ) = 0
mprotect(0xb77cc000, 4096, PROT_READ) = 0
munmap(0xb77a8000, 24326) = 0
brk(0) = 0x8db0000
brk(0x8dd1000) = 0x8dd1000
open("/usr/lib/locale/locale-archive", O_RDONLY|O_LARGEFILE) = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=1527584, ...}) = 0
mmap2(NULL, 1527584, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb74eb000
close(3) = 0
unshare(0x40000000 / CLONE_??? /) = 0
execve("/usr/local/sbin/dived", ["dived", "/var/run/dived.sock", "-p", "/var/run/dived.pid", "-d"], [/ 14 vars /]) = -1 ENOENT (No such file or directory)
execve("/usr/local/bin/dived", ["dived", "/var/run/dived.sock", "-p", "/var/run/dived.pid", "-d"], [/ 14 vars */]) = 0
brk(0) = 0x9ee2000
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
mmap2(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb77a9000
access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY) = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=24326, ...}) = 0
mmap2(NULL, 24326, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb77a3000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
open("/lib/i686/cmov/libc.so.6", O_RDONLY) = 3
read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\0n\1\0004\0\0\0"..., 512) = 512
fstat64(3, {st_mode=S_IFREG|0755, st_size=1327556, ...}) = 0
mmap2(NULL, 1337704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb765c000
mprotect(0xb779c000, 4096, PROT_NONE) = 0
mmap2(0xb779d000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x140) = 0xb779d000
mmap2(0xb77a0000, 10600, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb77a0000
close(3) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb765b000
set_thread_area({entry_number:-1 -> 6, base_addr:0xb765b8d0, limit:1048575, seg_32bit:1, contents:0, read_exec_only:0, limit_in_pages:1, seg_not_present:0, useable:1}) = 0
mprotect(0xb779d000, 8192, PROT_READ) = 0
mprotect(0xb77c7000, 4096, PROT_READ) = 0
munmap(0xb77a3000, 24326) = 0
rt_sigaction(SIGCHLD, {0x8049344, [], 0}, NULL, 8) = 0
unlink("/var/run/dived.sock") = 0
socket(PF_FILE, SOCK_STREAM, 0) = 3
bind(3, {sa_family=AF_FILE, path="/var/run/dived.sock"}, 110) = 0
listen(3, 10) = 0
clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0xb765b938) = 15811
exit_group(0) = ?

------------------------------------------------- dive

root@debian:~# strace dive /var/run/dived.sock ip add
execve("/usr/local/bin/dive", ["dive", "/var/run/dived.sock", "ip", "add"], [/* 14 vars */]) = 0
brk(0) = 0x8f73000
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
mmap2(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7779000
access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY) = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=24326, ...}) = 0
mmap2(NULL, 24326, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb7773000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
open("/lib/i686/cmov/libc.so.6", O_RDONLY) = 3
read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\0n\1\0004\0\0\0"..., 512) = 512
fstat64(3, {st_mode=S_IFREG|0755, st_size=1327556, ...}) = 0
mmap2(NULL, 1337704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb762c000
mprotect(0xb776c000, 4096, PROT_NONE) = 0
mmap2(0xb776d000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x140) = 0xb776d000
mmap2(0xb7770000, 10600, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb7770000
close(3) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb762b000
set_thread_area({entry_number:-1 -> 6, base_addr:0xb762b6c0, limit:1048575, seg_32bit:1, contents:0, read_exec_only:0, limit_in_pages:1, seg_not_present:0, useable:1}) = 0
mprotect(0xb776d000, 8192, PROT_READ) = 0
mprotect(0xb7797000, 4096, PROT_READ) = 0
munmap(0xb7773000, 24326) = 0
socket(PF_FILE, SOCK_STREAM, 0) = 3
connect(3, {sa_family=AF_FILE, path="/var/run/dived.sock"}, 110) = -1 ECONNREFUSED (Connection refused)
dup(2) = 4
fcntl64(4, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
brk(0) = 0x8f73000
brk(0x8f94000) = 0x8f94000
fstat64(4, {st_mode=S_IFCHR|0600, st_rdev=makedev(136, 2), ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7778000
_llseek(4, 0, 0xbf8e8da8, SEEK_CUR) = -1 ESPIPE (Illegal seek)
write(4, "connect: Connection refused\n", 28connect: Connection refused
) = 28
close(4) = 0
munmap(0xb7778000, 4096) = 0
exit_group(2) = ?

------------------------------------------------------ one more thing
I straced dived without the -d. It does wait on the socket as it should but I still get connection refused:

from dive.

Quick update: I installed 3.2.0 kernel from Debian back ports and now it works fine. I'm pretty sure that it is something to do with the stock kernel. I'm guessing that when you do unshare -n, it considers the UNIX sockets as in a separate name space that's why it becomes in accessible afterwards. It could be a bug in 2.6.32 or just a behavior change, can't be sure. But if I had to guess I would think it is a bug, here is why:
On stock 2.6.32, when I attempt to do the unshare directly from dived (with the -s net option), it sigfaults. When I examine the core file, it shows that the sigfault happens inside the kernel.

You mentioned that you also have Debian 2.6.32-5 but self-compiled. Did you change kernel config options or did you apply patches?

from dive.

I currently use "Debian squeeze/wheezy/sid"; kernel is "3.3.6-pf-vi+" (not 2.6.32-5), with various patches (unrelated to dived work).

Yesterday I tested on plain Debian Squeeze 2.6.35 (but without unshare - just not remembered about it and it wasn't mentioned before).

In my kernel, "unshare -n" have effect on network interfaces and abstract UNIX sockets, but not on UNIX filesystem sockets (as long as it is on shared filesystem between host and container) - for example, I can start "unshare -n xterm" and it just works (Xorg listen both filesystem and abstract socket).

If older kernel does not allow UNIX sockets across network namespaces, "-s net" won't help (I shouldn't crash in dived although of course) - it should be equivalent "unshare -n dived ...".

P.S. Have you come here from this question?

from dive.

Actually using the "-s" option with dived will always crash due to a bug in your code. The bug is this:
after you allocate the stack for the clone call, you need to point to the end of the stack area like this:

    int cpid = clone( (int(*)(void*)) serve, stack+1024*16, CLONE_VM|flags, opts);

this is according to the clone man page:
" The child_stack argument specifies the location of the stack used by the child process. Since the child and calling process may share memory, it is not possible for the child process to execute in the same stack as the calling process. The calling process
must therefore set up memory space for the child stack and pass a pointer to this space to clone(). Stacks grow downwards on all processors that run Linux (except the HP PA processors), so child_stack usually points to the topmost address of the memory space
set up for the child stack.
"

from dive.

Thanks, sort of fixed.

from dive.

I would also suggest you make the stack size configurable.

from dive.

Now it's a #define near the beginning.

from dive.

(Thinking what will happen if create UNIX socket prior to "clone" call. Maybe this can workaround working in 2.6.32...)

from dive.

dive v1.0 works on 2.6.32 for this use case: it opens the socket before doing clone.

Using "--pidfile", "--detach", "--chroot" and "--unshare" together should work (pidfile is created on host side, before chrooting).

from dive.