lkml.org 
[lkml]   [2017]   [Dec]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [PATCH] netlink: Add netns check on taps
On Tue, Dec 5, 2017 at 6:19 PM, David Ahern <dsahern@gmail.com> wrote:
>> + if (!net_eq(dev_net(dev), sock_net(sk)) &&
>> + !net_eq(dev_net(dev), &init_net)) {
>
> Why is init_net special? Seems like snooping should be limited to the
> namespace you are in.

Depends how important it is to preserve the current "typical use case"
behavior, where the root user in the init netns can see all netlink
traffic on the system.

\
 
 \ /
  Last update: 2017-12-06 04:16    [W:0.119 / U:0.176 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site