lkml.org 
[lkml]   [2015]   [Sep]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: [PATCH 3/3] net/udevns: Netlink module to forward uevent to containers
    From
    Date
    On 9/10/2015 9:05 PM, Eric W. Biederman wrote:
    > "Michael J. Coss" <michael.coss@alcatel-lucent.com> writes:
    >
    >> New generic netlink module to provide an interface with the new
    >> forwarding interface for uevent. The driver allows a user to
    >> direct a uevent as read from the kernel to a specific network
    >> namespace by providing the uevent message, and a target process id.
    >> The uapi header file provides the message format.
    > If we can't just pass the message thourgh I don't expect genetlink is a
    > particularly good interface for this.
    >
    > It would be nice if we could open some appropriate thing and the act of
    > getting a file descriptor ould suppress all of the uevent broadcast
    > messages in that network namespace.
    >
    > Further GENL_ADMIN_PERM is an unfortunate choice for a permission check.
    > I don't see it as exploitable but I am not certain CAP_SYS_ADMIN is the
    > best capability to check. Beyond that we probably want to arrange
    > things so that we can use ns_capable so we can allow containers to hand
    > off their devices to child containers.
    >
    > Implementations that do not allow for containers to nest bother me.
    >
    >
    I've done several different approaches with this. I really just wanted
    an interface to the kernel function to provide forwarding. The first
    choice was just a pseudo device that you wrote uevent messages to and
    that message was forwarded. This is yet another take on that. I'm not
    sure whether one is better or worse than the other.

    Thanks for the feedback.

    --
    ---Michael J Coss



    \
     
     \ /
      Last update: 2015-09-11 21:21    [W:4.036 / U:0.000 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site