feat: add new none network

[antrusd]

This PR will add net none driver support. The driver almost similar with host but only provide lo interface configured. This is follow up from #427 .

[AkihiroSuda]

$ rootlesskit --net=none bash
WARN[0000] [rootlesskit:parent] specifying --disable-host-loopback is highly recommended to prohibit connecting to 127.0.0.1:* on the host namespace (requires pasta, slirp4netns, or VPNKit) 

This warning should not be printed for --net-none

[AkihiroSuda]

"builtin" may work too?

[antrusd]

right, updated

[AkihiroSuda]

Got an error:

$ rootlesskit --net=none --detach-netns bash
WARN[0000] [rootlesskit:parent] specifying --disable-host-loopback is highly recommended to prohibit connecting to 127.0.0.1:* on the host namespace (requires pasta, slirp4netns, or VPNKit) 
nsenter: reassociate to namespace 'ns/net' failed: Operation not permitted
[rootlesskit:parent] error: failed to setup network &{}: exit status 1
[rootlesskit:child ] error: EOF

[antrusd]

hmm, I never use --detach-netns actually, missed the test.

but then none network driver shouldn't have --detach-netns support since we don't have any network but loopback ?

[AkihiroSuda]

none may support --detach-netns for consistency with other network drivers, but not a hard requirement.

[antrusd]

sorry, I may not really understand --detach-netns well enough. I tried to put the sleep infinity before configure loopback, then if I end up something similar with --net=host, is this expected ?

	if detachedNetNSPath != "" {
		cmd := exec.Command("nsenter", "-t", strconv.Itoa(childPID), "-n"+detachedNetNSPath, "--no-fork", "-m", "-U", "--preserve-credentials", "sleep", "infinity")
		cmd.SysProcAttr = &syscall.SysProcAttr{
			Pdeathsig: syscall.SIGKILL,
		}
		err := cmd.Start()
		if err != nil {
			return nil, nil, err
		}
		childPID = cmd.Process.Pid
	}

	cmds := [][]string{
		[]string{"nsenter", "-t", strconv.Itoa(childPID), "--no-fork", "-n", "-m", "-U", "--preserve-credentials", "ip", "address", "add", "127.0.0.1/8", "dev", "lo"},
		[]string{"nsenter", "-t", strconv.Itoa(childPID), "--no-fork", "-n", "-m", "-U", "--preserve-credentials", "ip", "link", "set", "lo", "up"},
	}
	if err := common.Execs(os.Stderr, os.Environ(), cmds); err != nil {
		return nil, nil, err
	}

[antrusd]

if that so, then configuring loppback when --detach-netns seems useless.

[AkihiroSuda]

rootlesskit --net=none --detach-netns bash will run bash in the host netns, and detach a new lo-only netns in $ROOTLESSKIT_STATE_DIR/netns.

[antrusd]

got it, updated

[antrusd]

$ rootlesskit --net=none bash
WARN[0000] [rootlesskit:parent] specifying --disable-host-loopback is highly recommended to prohibit connecting to 127.0.0.1:* on the host namespace (requires pasta, slirp4netns, or VPNKit) 

This warning should not be printed for --net-none

Updated here

[AkihiroSuda]

Thanks