Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1223044

Re: [PATCH 3/3] net/udevns: Netlink module to forward uevent to containers

Show all headers | View raw

On 9/10/2015 9:05 PM, Eric W. Biederman wrote:
> "Michael J. Coss" <michael.coss@alcatel-lucent.com> writes:
>
>> New generic netlink module to provide an interface with the new
>> forwarding interface for uevent.  The driver allows a user to
>> direct a uevent as read from the kernel to a specific network
>> namespace by providing the uevent message, and a target process id.
>> The uapi header file provides the message format.
> If we can't just pass the message thourgh I don't expect genetlink is a
> particularly good interface for this.
>
> It would be nice if we could open some appropriate thing and the act of
> getting a file descriptor ould suppress all of the uevent broadcast
> messages in that network namespace.
>
> Further GENL_ADMIN_PERM is an unfortunate choice for a permission check.
> I don't see it as exploitable but I am not certain CAP_SYS_ADMIN is the
> best capability to check.    Beyond that we probably want to arrange
> things so that we can use ns_capable so we can allow containers to hand
> off their devices to child containers.
>
> Implementations that do not allow for containers to nest bother me.
>
>
I've done several different approaches with this.  I really just wanted
an interface to the kernel function to provide forwarding.  The first
choice was just a pseudo device that you wrote uevent messages to and
that message was forwarded.  This is yet another take on that.  I'm not
sure whether one is better or worse than the other.

Thanks for the feedback.

-- 
---Michael J Coss

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 0/3] kobject: support namespace aware udev "Michael J. Coss" <michael.coss@alcatel-lucent.com> - 2015-09-09 04:30 +0200
  [PATCH 3/3] net/udevns: Netlink module to forward uevent to containers "Michael J. Coss" <michael.coss@alcatel-lucent.com> - 2015-09-09 04:30 +0200
    Re: [PATCH 3/3] net/udevns: Netlink module to forward uevent to containers ebiederm@xmission.com (Eric W. Biederman) - 2015-09-11 03:20 +0200
      Re: [PATCH 3/3] net/udevns: Netlink module to forward uevent to  containers Michael J Coss <michael.coss@alcatel-lucent.com> - 2015-09-11 21:10 +0200
  [PATCH 2/3] lib/kobject_uevent.c: add uevent forwarding function "Michael J. Coss" <michael.coss@alcatel-lucent.com> - 2015-09-09 04:30 +0200
    Re: [PATCH 2/3] lib/kobject_uevent.c: add uevent forwarding function Greg KH <gregkh@linuxfoundation.org> - 2015-09-09 20:30 +0200
      Re: [PATCH 2/3] lib/kobject_uevent.c: add uevent forwarding function Michael J Coss <michael.coss@alcatel-lucent.com> - 2015-09-09 21:30 +0200
        Re: [PATCH 2/3] lib/kobject_uevent.c: add uevent forwarding function Greg KH <gregkh@linuxfoundation.org> - 2015-09-09 22:20 +0200
          Re: [PATCH 2/3] lib/kobject_uevent.c: add uevent forwarding function Amir Goldstein <amir@cellrox.com> - 2015-09-10 07:50 +0200
            Re: [PATCH 2/3] lib/kobject_uevent.c: add uevent forwarding function Greg KH <gregkh@linuxfoundation.org> - 2015-09-10 08:00 +0200
    Re: [PATCH 2/3] lib/kobject_uevent.c: add uevent forwarding function ebiederm@xmission.com (Eric W. Biederman) - 2015-09-11 03:10 +0200
      Re: [COMMERCIAL] Re: [PATCH 2/3] lib/kobject_uevent.c: add uevent  forwarding function Michael J Coss <michael.coss@alcatel-lucent.com> - 2015-09-11 20:50 +0200
  [PATCH 1/3] lib/kobject_uevent.c: disable broadcast of uevents to other namespaces "Michael J. Coss" <michael.coss@alcatel-lucent.com> - 2015-09-09 04:30 +0200
    Re: [PATCH 1/3] lib/kobject_uevent.c: disable broadcast of uevents to other namespaces ebiederm@xmission.com (Eric W. Biederman) - 2015-09-11 02:50 +0200
      Re: [PATCH 1/3] lib/kobject_uevent.c: disable broadcast of uevents to  other namespaces Michael J Coss <michael.coss@alcatel-lucent.com> - 2015-09-11 20:30 +0200
  Re: [PATCH 0/3] kobject: support namespace aware udev Greg KH <gregkh@linuxfoundation.org> - 2015-09-09 20:30 +0200
    Re: [PATCH 0/3] kobject: support namespace aware udev Michael J Coss <michael.coss@alcatel-lucent.com> - 2015-09-09 21:10 +0200
      Re: [PATCH 0/3] kobject: support namespace aware udev Greg KH <gregkh@linuxfoundation.org> - 2015-09-09 22:10 +0200
        Re: [PATCH 0/3] kobject: support namespace aware udev Michael J Coss <michael.coss@alcatel-lucent.com> - 2015-09-09 22:20 +0200
          Re: [PATCH 0/3] kobject: support namespace aware udev Greg KH <gregkh@linuxfoundation.org> - 2015-09-09 22:30 +0200
            Re: [COMMERCIAL] Re: [PATCH 0/3] kobject: support namespace aware  udev Michael J Coss <michael.coss@alcatel-lucent.com> - 2015-09-09 23:00 +0200
              Re: [COMMERCIAL] Re: [PATCH 0/3] kobject: support namespace aware  udev Greg KH <gregkh@linuxfoundation.org> - 2015-09-10 07:30 +0200

csiph-web