lkml.org 
[lkml]   [2015]   [Sep]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    SubjectRe: [PATCH 1/3] lib/kobject_uevent.c: disable broadcast of uevents to other namespaces
    "Michael J. Coss" <michael.coss@alcatel-lucent.com> writes:

    > Restrict sending uevents to only those listeners operating in the same
    > network namespace as the system init process. This is the first step
    > toward allowing policy control of the forwarding of events to other
    > namespaces in userspace.

    This limitation whould be better if we only skipped network namespaces
    where you are sending spoofed uevents.

    As it sits this has the possibility to break userspace.

    Eric

    > Signed-off-by: Michael J. Coss <michael.coss@alcatel-lucent.com>
    > ---
    > lib/kobject_uevent.c | 4 ++++
    > 1 file changed, 4 insertions(+)
    >
    > diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c
    > index f6c2c1e..d791e33 100644
    > --- a/lib/kobject_uevent.c
    > +++ b/lib/kobject_uevent.c
    > @@ -295,6 +295,10 @@ int kobject_uevent_env(struct kobject *kobj, enum kobject_action action,
    > if (!netlink_has_listeners(uevent_sock, 1))
    > continue;
    >
    > + /* forward event only to the host systems network namespaces */
    > + if (!net_eq(sock_net(uevent_sock), &init_net))
    > + continue;
    > +
    > /* allocate message with the maximum possible size */
    > len = strlen(action_string) + strlen(devpath) + 2;
    > skb = alloc_skb(len + env->buflen, GFP_KERNEL);


    \
     
     \ /
      Last update: 2015-09-11 03:01    [W:2.306 / U:0.612 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site