netdev - Re: [PATCH 0/2] net: Implement SO_PEERCGROUP and SO

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 23 Apr 2014 16:53:31 -0400
From:	Daniel J Walsh <dwalsh@...hat.com>
To:	Vivek Goyal <vgoyal@...hat.com>,
	Andy Lutomirski <luto@...capital.net>
CC:	David Miller <davem@...emloft.net>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	cgroups@...r.kernel.org,
	Network Development <netdev@...r.kernel.org>,
	Tejun Heo <tj@...nel.org>, Simo Sorce <ssorce@...hat.com>,
	lpoetter@...hat.com, kay@...hat.com
Subject: Re: [PATCH 0/2] net: Implement SO_PEERCGROUP and SO_PASSCGROUP socket
 options


On 04/23/2014 03:05 PM, Vivek Goyal wrote:
> On Tue, Apr 22, 2014 at 01:31:13PM -0700, Andy Lutomirski wrote:
> [..]
>>> Otherwise, without SO_PASSCGROUP, there is no way for datagram sockets
>>> to find out the peer's open() time cgroup.
>> Right.
>>
>> I'd still like to know what userspace applications want this feature.
>> The canonical example seems to be journald, but journald doesn't use
>> unix datagram sockets AFAICS,
> Dan Walsh mentiond that systemd also monitors /dev/log (datagram socket) and
> logs everything in journal. There this information should be useful.
>
> Thanks
> Vivek
I am fine with collecting only the information available at "open".  I
can potentially see other Userspace Resource Constraints being built
based on the Cgroup the process is in.  For example openshift wants to 
limit the amount of email a process can send to only a few per second,
which might be able to be controlled by a relay listening on a
particular socket. Then it could change the rules based on the
Cgroup/Unit file the calling process was in. 
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html