Re: [gentoo-dev] Re: call for testers: udev predictable network interface names

[William Hubbs]

On Sat, Jan 12, 2013 at 02:11:43AM +0000, Steven J. Long wrote:
> Christopher Head wrote:
> > William Hubbs <williamh@g.o> wrote:
> >
> > > There is a way for users to opt out if we default this to on, but I
> > > think the new naming scheme has advantages over the traditional eth*
> > > wlan* etc names.
> >
> > I think it should be taken with a grain of salt. The page mentions how
> > it lets you replace a failed NIC without losing its name. But given a
> > simple computer with just one NIC, if the NIC fails and is replaced
> > (perhaps by a different type of NIC in a different slot, or perhaps an
> > onboard NIC disabled in the BIOS and replaced by an add-in), the name
> > could change, while the kernel’s automatically assigned name will not:
> > eth0 (this also applies to a computer with one Ethernet NIC and one
> > wifi NIC: eth0 and wlan0). That fact was never mentioned on the wiki
> > page, even though it applies to a heck of a lot of systems. Perhaps
> > something to include when the Gentoo docs are put together, as part of
> > the balance of reasons to choose one way or the other?
> >
> That's a very good point. For the vast majority of users all these
> "desktop" changes are supposed to help, it's not at all relevant.
> Obviously it's good to have the functionality should you need it, but
> again it appears that simple cases are being made complex, just to allow
> for someone else's complex cases. Which is faulty logic.
>
> While many packages have default configurations, changing the default
> setup for base system packages in the absence of any configuration is
> not generally a good idea, unless you know for a fact it's not going to
> mess anything up (which is a big ask given that you're distributing
> source.)
>
> Especially given the arguments presented as a motivation, that all this
> has "serious security implications, for example in firewall rules which
> are coded for certain naming schemes, and which are hence very sensitive
> to unpredictable changing names."

Isn't this the very definition of the kernel-based names? if you do not
have a persistent net rules file, you are subject to the kernel's naming
order, and I have heard of situations in the past when people upgrade
their kernels, etc, and when they reboot their interface names are
changed around.

> If you're certain that every user with a current simple setup, who
> uses the kernel default names, and has such a firewall setup isn't
> going to suddenly find their interface name changed when they reboot,
> fair play to you. If not, allow the admin to opt-in, rather than force
> them to opt-out when something breaks.

The following is taken from the wiki:

"
I don't like this, how do I disable this?
 
You basically have three options: 

1.  You disable the assignment of fixed names, so that the unpredictable
kernel names are used again. For this, simply mask udev's rule file for
the default policy:
ln -s /dev/null /etc/udev/rules.d/80-net-name-slot.rules 

2.  You create your own manual naming scheme, for example by naming your
interfaces "internet0", "dmz0" or "lan0". For that create your own udev
rules file and set the NAME property for the devices. Make sure to
order it before the default policy file, for example by naming it
/etc/udev/rules.d/70-my-net-names.rules 

3.  You alter the default policy file, for picking a different naming
scheme, for example for naming all interface names after their MAC
address by default:

cp /usr/lib/udev/rules.d/80-net-name-slot.rules /etc/udev/rules.d/80-net-name-slot.rules,

then edit the file there and change the lines as necessary. 
"

If you have upgraded your udev, you see that you have the file
/etc/udev/rules.d/80-net-name-slot.rules. This file is only created
*once*, when you upgrade from a version of udev lower than 197. This
means when this version of udev goes stable, new installs will not
have this file created.

If you have a file that fits the requirements of option 2 (which
70-persistent-net.rules does) in your
/etc/udev/rules.d, you can rm 80-net-name-slot.rules and you will not be
affected.

If you do not have a file in /etc/udev/rules.d that fits the
requirements of option 2 and you remove 80-net-name-slot.rules, your
interface names will change on your next reboot, so you should be
prepared for that. The created version of
/etc/udev/rules.d/80-net-name-slot.rules has comments explaining how to
get the new names of your network interfaces before the reboot so you
can reconfigure.

William