On 9/10/2015 8:36 PM, Eric W. Biederman wrote: > "Michael J. Coss" <michael.c...@alcatel-lucent.com> writes: > >> Restrict sending uevents to only those listeners operating in the same >> network namespace as the system init process. This is the first step >> toward allowing policy control of the forwarding of events to other >> namespaces in userspace. > This limitation whould be better if we only skipped network namespaces > where you are sending spoofed uevents. > > As it sits this has the possibility to break userspace. > > Eric > While I don't necessarily see how this could cause an issue with userspace, I agree that it could be made to work that way and accomplish the same goal and be even more transparent. I would think that it would require some state in the network namespace that would be settable to say enable/disable host uevent broadcasts across this particular netlink socket.
---Michael J Coss -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
