unify default --with-piddir

[manuelbuil]

Hi! According to the wiki:https://wiki.strongswan.org/projects/strongswan/wiki/Netns, if we want to use strongswan with namespaces we are forced to recompile with the config: --with-piddir=/etc/ipsec.d/run as default is /var/run. Assuming everything keeps working when moving to the path to /etc/ipsec.d/run, wouldn't it simplify our lives if we used /etc/ipsec.d/run as default piddir? In that case we would not need two binaries depending on the use case, or? Thanks!

[Thermi]

Stuff like pids and belongs into /var/run. See man 7 hier:

       /etc   Contains configuration files which are local to the machine.  Some larger software packages, like X11, can have their own subdirectories below /etc.   Site-wide  configuration  files  may  be
              placed here or in /usr/etc.  Nevertheless, programs should always look for these files in /etc and you may have links for these files to /usr/etc.
[...]
       /var/run
              Run-time variable files, like files holding process identifiers (PIDs) and logged user information (utmp).  Files in this directory are usually cleared when the system boots.

EDIT: The path /etc/ipsec.d/run is just an example. A better variant would be /var/run/strongswan/ns/ or something.

[manuelbuil]

Thanks! So let me rephrase the question, why don't we use /var/run/strongswan/ns/ or other as the default directory so that we don't need two binaries (one for non-namespace and namespace use cases)?

[Thermi]

That'd need reflection in any distro packages and that kind of coordination rarely works well the first time.
Package maintainers are often very far removed from their actual users.

EDIT: Reflection as in apparmor profiles, SELinux policies, ..., so the daemon works again after the change to the pid dir.

[vadorovsky]

I agree with @Thermi that using /etc for volatile files (including pidfiles) is a bad practice, though there is one reason why Strongswan docs recommend doing that. They rely in iproute2's behavior - ip netns is bind mounting /etc/netns/[name] directories content into /etc. See the man page: https://man7.org/linux/man-pages/man8/ip-netns.8.html

For applications that are aware of network namespaces, the convention is to look for global network configuration files first
 in /etc/netns/NAME/ then in /etc/. For example, if you want a different version of /etc/resolv.conf for a network namespace
 used to isolate your vpn you would name it /etc/netns/myvpn/resolv.conf.

ip netns exec automates handling of this configuration, file convention for network namespace unaware applications, by creat-
 ing a mount namespace and bind mounting all of the per network namespace configure files into their traditional location in
 /etc.

Since Strongswan doesn't really have any native support for namespaces or for running multiple instances, they use the behavior of iproute2 as a hack. They recommend keeping pidfiles in /etc so /etc/netns/[name]/ipsec.d/run would get bind mounted by iproute2.

I see two potential solutions to avoid keeping pidfiles in /etc while supporting multiple Strongswan instances for multiple network namespaces:

• adding a possibility to bind mount stuff from /run, /var/run or user defined directories in iproute2 ip netns command (so far there is no such possibility)
• feature in strongswan to be able to specify a pidfile location on runtime, or somehow make it aware of namespaces and provide some user-friendly way to use them inside netns

[Thermi]

There's no need to make it somehow namespace aware with the current feature set.
strongSwan is designed, because IKE and IPsec are architectured as a system secure, as a system daemon, not one that runs in several instances.

The easiest solution would be to pass a PIDFILE location per invocation.