Messages in this thread | | | Subject | Re: [PATCH 1/3] lib/kobject_uevent.c: disable broadcast of uevents to other namespaces | From | Michael J Coss <> | Date | Fri, 11 Sep 2015 14:21:13 -0400 |
| |
On 9/10/2015 8:36 PM, Eric W. Biederman wrote: > "Michael J. Coss" <michael.coss@alcatel-lucent.com> writes: > >> Restrict sending uevents to only those listeners operating in the same >> network namespace as the system init process. This is the first step >> toward allowing policy control of the forwarding of events to other >> namespaces in userspace. > This limitation whould be better if we only skipped network namespaces > where you are sending spoofed uevents. > > As it sits this has the possibility to break userspace. > > Eric > While I don't necessarily see how this could cause an issue with userspace, I agree that it could be made to work that way and accomplish the same goal and be even more transparent. I would think that it would require some state in the network namespace that would be settable to say enable/disable host uevent broadcasts across this particular netlink socket.
---Michael J Coss
| |