ujail: DNS regression with a standalone /etc/resolv.conf after 3f61bf11

Aperta
  • Qualcosa non va?
#66 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 4 giorni

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
68/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
c, linux
Ambito
backend, operating-systems

Direzione di ricerca

Start by reading the resolv_conf_link_target() logic described in the issue and the host-network jail mount handling in procd. Compare how it handles a standalone /etc/resolv.conf with one resolving into /tmp/resolv.conf.d, then reproduce both cases using the supplied ujail commands. Done means the jail uses the host resolver in both cases while directory sharing still reflects resolver updates.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Description

Commit 3f61bf11b41a — jail: share the live resolv.conf with host-network jails causes host-network jails to use a different resolver configuration from the host when /etc/resolv.conf is a standalone file.

On my router, this prevents jailed sysntpd from resolving its NTP server. The daemon remains running, but the clock is never synchronized.

Environment
  • OpenWrt SNAPSHOT r38095-df5dc61652
  • Target: mediatek/filogic
  • Architecture: aarch64_cortex-a53
  • procd-ujail: 2026.11.03~fb611687-r1
  • dnsmasq DNS service disabled with option port '0'

The host has a standalone /etc/resolv.conf containing:

nameserver 114.114.114.114

Meanwhile, /tmp/resolv.conf.d/resolv.conf contains:

nameserver 127.0.0.1
nameserver ::1

No DNS server listens on localhost. DNS resolution works on the host using /etc/resolv.conf.

Reproduction

With the configuration above:

cat /etc/resolv.conf

ujail -n resolver-default -U ntp -G ntp -c \
    -r /bin/cat \
    -- /bin/cat /etc/resolv.conf

ujail -n resolver-explicit -U ntp -G ntp -c \
    -r /bin/cat -r /etc/resolv.conf \
    -- /bin/cat /etc/resolv.conf

Actual output:

# Host
nameserver 114.114.114.114

# Jail with default resolver handling
nameserver 127.0.0.1
nameserver ::1

# Jail with explicit /etc/resolv.conf mount
nameserver 114.114.114.114
Expected behavior

A jail sharing the host network should honor the host's /etc/resolv.conf, including when it is a standalone file.

Directory sharing should preserve updates when the host resolver points into /tmp/resolv.conf.d, without overriding an independent resolver configuration.

Suspected cause

Before 3f61bf11, the host-network jail path called:

add_mount_bind("/etc/resolv.conf", 1, 0);

The new resolv_conf_link_target() first checks whether /tmp/resolv.conf.d/resolv.conf exists:

if (!access(HOST_RESOLV_CONF_DIR "/resolv.conf", F_OK))
    return strdup(".." JAIL_RESOLV_CONF_DIR "/resolv.conf");

This returns before checking realpath("/etc/resolv.conf"). Consequently, the existence of the generated file overrides a standalone host /etc/resolv.conf.

The installed fb611687 source contains this logic, and the runtime behavior above reproduces it.

A possible fix is to check the resolved host /etc/resolv.conf path first, using directory sharing only when that path lies within /tmp/resolv.conf.d. Otherwise, retain the file bind mount.

Workaround and verification

Adding the following immediately after procd_add_jail ntpd ubus in /etc/init.d/sysntpd works around the issue:

procd_add_jail_mount /etc/resolv.conf

After restarting sysntpd, the jail sees the correct resolver and the daemon automatically synchronizes the clock.

A separate read-only NTP query inside a jail with the explicit resolver mount successfully resolved ntp.aliyun.com and reported an offset within approximately ±2 ms after synchronization.

Lingua principale
C
Stelle
13
Fork
49
Merge medio
11g 12h
PR unite (30g)
3

Preparare l'ambiente

Questo progetto non fornisce container di sviluppo, Dockerfile né guida per i contributori, quindi l'ambiente è a tuo carico: parti dal suo README e consulta la nostra guida al primo contributo per i passaggi generali.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di openwrt/procd

Tutte le issue di openwrt/procd

Issue simili

Altre issue su C

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.