Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1222458

Re: [PATCH 1/3] lib/kobject_uevent.c: disable broadcast of uevents to other namespaces

From ebiederm@xmission.com (Eric W. Biederman)
Newsgroups linux.kernel
Subject Re: [PATCH 1/3] lib/kobject_uevent.c: disable broadcast of uevents to other namespaces
Date 2015-09-11 02:50 +0200
Message-ID <q7kHn-1AX-5@gated-at.bofh.it> (permalink)
References <q6Dj4-6hq-3@gated-at.bofh.it> <q6Dj4-6hq-11@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

"Michael J. Coss" <michael.coss@alcatel-lucent.com> writes:

> Restrict sending uevents to only those listeners operating in the same
> network namespace as the system init process.  This is the first step
> toward allowing policy control of the forwarding of events to other
> namespaces in userspace.

This limitation whould be better if we only skipped network namespaces
where you are sending spoofed uevents.

As it sits this has the possibility to break userspace.

Eric

> Signed-off-by: Michael J. Coss <michael.coss@alcatel-lucent.com>
> ---
>  lib/kobject_uevent.c | 4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c
> index f6c2c1e..d791e33 100644
> --- a/lib/kobject_uevent.c
> +++ b/lib/kobject_uevent.c
> @@ -295,6 +295,10 @@ int kobject_uevent_env(struct kobject *kobj, enum kobject_action action,
>  		if (!netlink_has_listeners(uevent_sock, 1))
>  			continue;
>  
> +		/* forward event only to the host systems network namespaces */
> +		if (!net_eq(sock_net(uevent_sock), &init_net))
> +			continue;
> +
>  		/* allocate message with the maximum possible size */
>  		len = strlen(action_string) + strlen(devpath) + 2;
>  		skb = alloc_skb(len + env->buflen, GFP_KERNEL);
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 0/3] kobject: support namespace aware udev "Michael J. Coss" <michael.coss@alcatel-lucent.com> - 2015-09-09 04:30 +0200
  [PATCH 3/3] net/udevns: Netlink module to forward uevent to containers "Michael J. Coss" <michael.coss@alcatel-lucent.com> - 2015-09-09 04:30 +0200
    Re: [PATCH 3/3] net/udevns: Netlink module to forward uevent to containers ebiederm@xmission.com (Eric W. Biederman) - 2015-09-11 03:20 +0200
      Re: [PATCH 3/3] net/udevns: Netlink module to forward uevent to  containers Michael J Coss <michael.coss@alcatel-lucent.com> - 2015-09-11 21:10 +0200
  [PATCH 2/3] lib/kobject_uevent.c: add uevent forwarding function "Michael J. Coss" <michael.coss@alcatel-lucent.com> - 2015-09-09 04:30 +0200
    Re: [PATCH 2/3] lib/kobject_uevent.c: add uevent forwarding function Greg KH <gregkh@linuxfoundation.org> - 2015-09-09 20:30 +0200
      Re: [PATCH 2/3] lib/kobject_uevent.c: add uevent forwarding function Michael J Coss <michael.coss@alcatel-lucent.com> - 2015-09-09 21:30 +0200
        Re: [PATCH 2/3] lib/kobject_uevent.c: add uevent forwarding function Greg KH <gregkh@linuxfoundation.org> - 2015-09-09 22:20 +0200
          Re: [PATCH 2/3] lib/kobject_uevent.c: add uevent forwarding function Amir Goldstein <amir@cellrox.com> - 2015-09-10 07:50 +0200
            Re: [PATCH 2/3] lib/kobject_uevent.c: add uevent forwarding function Greg KH <gregkh@linuxfoundation.org> - 2015-09-10 08:00 +0200
    Re: [PATCH 2/3] lib/kobject_uevent.c: add uevent forwarding function ebiederm@xmission.com (Eric W. Biederman) - 2015-09-11 03:10 +0200
      Re: [COMMERCIAL] Re: [PATCH 2/3] lib/kobject_uevent.c: add uevent  forwarding function Michael J Coss <michael.coss@alcatel-lucent.com> - 2015-09-11 20:50 +0200
  [PATCH 1/3] lib/kobject_uevent.c: disable broadcast of uevents to other namespaces "Michael J. Coss" <michael.coss@alcatel-lucent.com> - 2015-09-09 04:30 +0200
    Re: [PATCH 1/3] lib/kobject_uevent.c: disable broadcast of uevents to other namespaces ebiederm@xmission.com (Eric W. Biederman) - 2015-09-11 02:50 +0200
      Re: [PATCH 1/3] lib/kobject_uevent.c: disable broadcast of uevents to  other namespaces Michael J Coss <michael.coss@alcatel-lucent.com> - 2015-09-11 20:30 +0200
  Re: [PATCH 0/3] kobject: support namespace aware udev Greg KH <gregkh@linuxfoundation.org> - 2015-09-09 20:30 +0200
    Re: [PATCH 0/3] kobject: support namespace aware udev Michael J Coss <michael.coss@alcatel-lucent.com> - 2015-09-09 21:10 +0200
      Re: [PATCH 0/3] kobject: support namespace aware udev Greg KH <gregkh@linuxfoundation.org> - 2015-09-09 22:10 +0200
        Re: [PATCH 0/3] kobject: support namespace aware udev Michael J Coss <michael.coss@alcatel-lucent.com> - 2015-09-09 22:20 +0200
          Re: [PATCH 0/3] kobject: support namespace aware udev Greg KH <gregkh@linuxfoundation.org> - 2015-09-09 22:30 +0200
            Re: [COMMERCIAL] Re: [PATCH 0/3] kobject: support namespace aware  udev Michael J Coss <michael.coss@alcatel-lucent.com> - 2015-09-09 23:00 +0200
              Re: [COMMERCIAL] Re: [PATCH 0/3] kobject: support namespace aware  udev Greg KH <gregkh@linuxfoundation.org> - 2015-09-10 07:30 +0200

csiph-web