lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Tue, 23 Feb 2010 12:49:21 -0600 From: "Serge E. Hallyn" <serue@...ibm.com> To: Dan Smith <danms@...ibm.com> Cc: containers@...ts.osdl.org, netdev@...r.kernel.org Subject: Re: [PATCH 2/5] C/R: Basic support for network namespaces and devices (v4) Quoting Dan Smith (danms@...ibm.com): > SH> But there is no guarantee that the checkpointer is in the netns > SH> which we would call the 'top level' netns. Which means that, at > SH> restart, whether or not the devices which are in what we call the > SH> top level netns are in fact inherited or not, will depend on > SH> conditions of the checkpointer. Do we care? (I thought we did, > SH> but maybe we don't... it's unlikely to happen anyway) > > Well, when we discussed this on IRC with Oren, I think we came to the > conclusion that since network namespaces aren't hierarchical, that we > would restore things from the "viewpoint" of the process that > checkpointed them. It gives us a sane way to ensure that the peer > devices residing in the init netns can be put back there, even though we > don't checkpoint everything in the init netns (like eth0). > > If you checkpoint a veth from within the container and you have a peer > device that is outside the container (but not in a netns that is > checkpointed as part of a task), it's going to fail and tell you that > one of your peers leaked to the outside. I think that's sane and > preferred behavior, no? Well I don't think it is, but it's a fine starting point, so let's worry about it later. thanks, -serge > If you're using macvlan and you checkpoint > from within the container, I think you should be okay, as long as > there is a appropriately named device to base the restored devices on > in whatever netns your restore process is in. > > -- > Dan Smith > IBM Linux Technology Center > email: danms@...ibm.com -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists