Re: [PATCH net-next 0/6] vsock: assign the guest vsock device to a network namespace

[Stefano Garzarella <sgarzare@redhat.com>]

On Fri, Sep 04, 2026 at 10:30:28AM -0700, Bobby Eshleman wrote:
>On Fri, Sep 04, 2026 at 10:55:17AM +0200, Stefano Garzarella wrote:
>> On Wed, Sep 02, 2026 at 04:00:46PM -0700, Bobby Eshleman wrote:
>> > vsock network namespaces let a host put each VM in a namespace of its
>> > own. A guest has no equivalent yet. It has a single G2H device that
>> > cannot be assigned to a network namespace.
>>
>> Thanks for this, I'll do a proper review next week, in the mean time some
>> comments below:
>>
>> >
>> > This series lets a guest move that device into a network namespace. A
>> > new ioctl on /dev/vsock, IOCTL_VM_SOCKETS_ASSIGN_G2H_NETNS, assigns the
>> > device to the namespace of the calling process. The namespace's existing
>>
>> Why an ioctl?
>>
>> I'm asking because I'd like to know if you've already considered any
>> alternatives (sysfs, netlink, etc.)
>>
>> How do you think the ioctl should be used? Should we provide an userspace
>> tool, or extending some existing tools?
>>
>> Thanks,
>> Stefano
>
>Really only because /dev/vsock exists and the prior series used it.

Yeah, I vaguely remember that we may have discussed switching to netlink 
in that thread, but I can't find it.

>
>Considering netlink, it might be the better option because there is a
>lot of prior art solving problems we might have in the future. For
>example, I was thinking about when users suddenly lose access to vsock,
>with just the current assign ioctl there is no way for apps or users to
>figure out why this happened. We can have an ioctl() setter for user,
>but in netdev world users can actually get a notification via netlink as
>to which namespace the device went to and what its ifindex is there (see
>__dev_change_net_namespace() for the RTM_DELLINK and RTM_NEWLINK
>messages). There is probably more, but that's the case that comes to
>mind.

netlink seems like the right way to go, do you think it'll be a real 
pain to implement?

>
>>
>> > ns_mode then decides who may use it: a "global" namespace shares the
>> > device with every other global namespace, and a "local" namespace keeps
>> > the host connection to itself. The device starts out in the initial
>> > namespace, so until the ioctl is issued nothing has moved and no mode
>> > has changed. There is no explicit unassign as assigning the device back
>> > to the initial namespace is equivalent.
>> >
>> > The ioctl requires CAP_NET_ADMIN in the initial user namespace.
>> >
>> > Connections that can no longer reach the device after a move are reset,
>> > so that a namespace which has lost access cannot keep using a socket it
>> > opened while it still had access. Following netdevs, the device returns
>> > to the initial namespace when the namespace it was moved to is deleted.
>> >
>> > Transports opt in through a new netns_assign_allow callback. Only
>> > virtio-vsock implements it here.
>>
>> Why? (Not asking to support all the others, asking to explain the reason or
>> ask helps from others to extend it)
>>
>> Thanks,
>> Stefano
>
>Sure, can add a note here about extending it. I just didn't want to
>implement code without having an environment allowing me to test it.

It's fine, I'm not asking you to do it ;-)

Sorry again for the delay, I hope to review this series today/tomorrow.

Thanks,
Stefano