linux-kernel - [PATCH 0/3] kobject: support namespace aware udev

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Tue,  8 Sep 2015 22:10:27 -0400
From:	"Michael J. Coss" <michael.coss@...atel-lucent.com>
To:	gregkh@...uxfoundation.org, davem@...emloft.net,
	linux-kernel@...r.kernel.org, containers@...ts.linuxcontainers.org
Cc:	serge.hallyn@...ntu.com, stgraber@...ntu.com,
	"Michael J. Coss" <michael.coss@...atel-lucent.com>
Subject: [PATCH 0/3] kobject: support namespace aware udev

Currently when a uevent occurs, the event is replicated and sent to every
listener on the kernel netlink socket, ignoring network namespaces boundaries,
forwarding events to every listener in every network namespace.

With the expanded use of containers, it would be useful to be able to
regulate this flow of events to specific containers.  By restricting
the events to only the host network namespace, it allows for a userspace
program to provide a system wide policy on which events are routed where.

A new kernel function (kobject_uevent_forward) was added which allows
forwarding a given message to any uevent listeners in the network namespace
of the specified pid and a generic netlink module was added to provide an
interface to that kernel function.  This allows a userspace program to be
able to read the uevents via the libudev, and apply a policy (drop, forward,
or modify), and sending those uevents to a specific network namespace, and
by association to a specific container.

By allowing a controlled flow of uevents to a container, it is possible
for the container to run udevd, processing the event as normal while
allowing the host to maintain control over what events are sent.

Michael J. Coss (3):
  lib/kobject_uevent.c: disable broadcast of uevents to other namespaces
  lib/kobject_uevent.c: add uevent forwarding function
  net/udevns: Netlink module to forward uevent to containers

 include/linux/kobject.h     |   3 ++
 include/net/net_namespace.h |   3 ++
 include/uapi/linux/Kbuild   |   1 +
 include/uapi/linux/udevns.h |  19 ++++++++
 kernel/ksysfs.c             |  12 +++++
 lib/kobject_uevent.c        |  94 +++++++++++++++++++++++++++++++++++++
 net/Kconfig                 |   1 +
 net/Makefile                |   1 +
 net/udevns/Kconfig          |   9 ++++
 net/udevns/Makefile         |   5 ++
 net/udevns/udevns.c         | 112 ++++++++++++++++++++++++++++++++++++++++++++
 net/udevns/udevns.h         |  19 ++++++++
 12 files changed, 279 insertions(+)
 create mode 100644 include/uapi/linux/udevns.h
 create mode 100644 net/udevns/Kconfig
 create mode 100644 net/udevns/Makefile
 create mode 100644 net/udevns/udevns.c
 create mode 100644 net/udevns/udevns.h

-- 
2.4.6

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/