Messages in this thread | | | From | Kevin Cernekee <> | Date | Tue, 5 Dec 2017 19:14:59 -0800 | Subject | Re: [PATCH] netlink: Add netns check on taps |
| |
On Tue, Dec 5, 2017 at 6:19 PM, David Ahern <dsahern@gmail.com> wrote: >> + if (!net_eq(dev_net(dev), sock_net(sk)) && >> + !net_eq(dev_net(dev), &init_net)) { > > Why is init_net special? Seems like snooping should be limited to the > namespace you are in.
Depends how important it is to preserve the current "typical use case" behavior, where the root user in the init netns can see all netlink traffic on the system.
| |