Restrict sending uevents to only those listeners operating in the same
network namespace as the system init process. This is the first step
toward allowing policy control of the forwarding of events to other
namespaces in userspace.
Signed-off-by: Michael J. Coss <michael.c...@alcatel-lucent.com>
---
lib/kobject_uevent.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c
index f6c2c1e..d791e33 100644
--- a/lib/kobject_uevent.c
+++ b/lib/kobject_uevent.c
@@ -295,6 +295,10 @@ int kobject_uevent_env(struct kobject *kobj, enum
kobject_action action,
if (!netlink_has_listeners(uevent_sock, 1))
continue;
+ /* forward event only to the host systems network namespaces */
+ if (!net_eq(sock_net(uevent_sock), &init_net))
+ continue;
+
/* allocate message with the maximum possible size */
len = strlen(action_string) + strlen(devpath) + 2;
skb = alloc_skb(len + env->buflen, GFP_KERNEL);
--
2.4.6
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
