netdev - [PATCH 08/10] netfilter: nf_log: enable nflog in un-init net namespace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 7 Feb 2013 15:49:48 +0800
From:	Gao feng <gaofeng@...fujitsu.com>
To:	netfilter-devel@...r.kernel.org
Cc:	containers@...ts.linux-foundation.org, pablo@...filter.org,
	ebiederm@...ssion.com, netdev@...r.kernel.org, lve@...p.ru,
	Gao feng <gaofeng@...fujitsu.com>
Subject: [PATCH 08/10] netfilter: nf_log: enable nflog in un-init net namespace

Now all nf_loggers are support net namespace, we
can allow all net namespace to enable the nflog.

Signed-off-by: Gao feng <gaofeng@...fujitsu.com>
---
 net/netfilter/nf_log.c | 20 --------------------
 1 file changed, 20 deletions(-)

diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c
index b1e5126..392f64f 100644
--- a/net/netfilter/nf_log.c
+++ b/net/netfilter/nf_log.c
@@ -33,9 +33,6 @@ static struct nf_logger *__find_logger(int pf, const char *str_logger)
 
 void nf_log_set(struct net *net, u_int8_t pf, struct nf_logger *logger)
 {
-	if (!net_eq(net, &init_net))
-		return;
-
 	if (pf != NFPROTO_UNSPEC) {
 		const struct nf_logger *llog;
 		mutex_lock(&nf_log_mutex);
@@ -54,9 +51,6 @@ void nf_log_unset(struct net *net, struct nf_logger *logger)
 	int i;
 	const struct nf_logger *c_logger;
 
-	if (!net_eq(net, &init_net))
-		return;
-
 	mutex_lock(&nf_log_mutex);
 	for (i = 0; i < NFPROTO_NUMPROTO; i++) {
 		c_logger = rcu_dereference_protected(net->ct.nf_loggers[i],
@@ -91,7 +85,6 @@ int nf_log_register(u_int8_t pf, struct nf_logger *logger)
 
 	mutex_unlock(&nf_log_mutex);
 
-	nf_log_set(&init_net, pf, logger);
 	return 0;
 }
 EXPORT_SYMBOL(nf_log_register);
@@ -105,16 +98,12 @@ void nf_log_unregister(struct nf_logger *logger)
 		list_del(&logger->list[i]);
 
 	mutex_unlock(&nf_log_mutex);
-	nf_log_unset(&init_net, logger);
 }
 EXPORT_SYMBOL(nf_log_unregister);
 
 int nf_log_bind_pf(struct net *net, u_int8_t pf,
 		   const struct nf_logger *logger)
 {
-	if (!net_eq(net, &init_net))
-		return 0;
-
 	if (pf >= ARRAY_SIZE(net->ct.nf_loggers))
 		return -EINVAL;
 
@@ -131,9 +120,6 @@ EXPORT_SYMBOL(nf_log_bind_pf);
 
 void nf_log_unbind_pf(struct net *net, u_int8_t pf)
 {
-	if (!net_eq(net, &init_net))
-		return;
-
 	if (pf >= ARRAY_SIZE(net->ct.nf_loggers))
 		return;
 
@@ -156,9 +142,6 @@ void nf_log_packet(struct net *net,
 	char prefix[NF_LOG_PREFIXLEN];
 	const struct nf_logger *logger;
 
-	if (!net_eq(net, &init_net))
-		return;
-
 	rcu_read_lock();
 	logger = rcu_dereference(net->ct.nf_loggers[pf]);
 	if (logger) {
@@ -272,9 +255,6 @@ static int nf_log_proc_dostring(ctl_table *table, int write,
 	struct net *net = current->nsproxy->net_ns;
 
 	if (write) {
-		if (!net_eq(net, &init_net))
-			return -EPERM;
-
 		if (size > sizeof(buf))
 			size = sizeof(buf);
 		if (copy_from_user(buf, buffer, size))
-- 
1.7.11.7

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html