linux-kernel - Re: [PATCH 0/3] kobject: support namespace aware udev

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 9 Sep 2015 15:05:29 -0400
From:	Michael J Coss <michael.coss@...atel-lucent.com>
To:	Greg KH <gregkh@...uxfoundation.org>
Cc:	davem@...emloft.net, linux-kernel@...r.kernel.org,
	containers@...ts.linuxcontainers.org, serge.hallyn@...ntu.com,
	stgraber@...ntu.com
Subject: Re: [PATCH 0/3] kobject: support namespace aware udev

On 9/8/2015 11:54 PM, Greg KH wrote:
> On Tue, Sep 08, 2015 at 10:10:27PM -0400, Michael J. Coss wrote:
>> Currently when a uevent occurs, the event is replicated and sent to every
>> listener on the kernel netlink socket, ignoring network namespaces boundaries,
>> forwarding events to every listener in every network namespace.
>>
>> With the expanded use of containers, it would be useful to be able to
>> regulate this flow of events to specific containers.  By restricting
>> the events to only the host network namespace, it allows for a userspace
>> program to provide a system wide policy on which events are routed where.
> Interesting, but why do you need a container to get a uevent at all?
> What uevents do a container care about?
>
> thanks,
>
> greg k-h
>
In our use case, we run a full desktop inside the container, including
X.  We run the Xserver in headless mode, and forward a uevent to the
container to allow binding/unbinding of remote keyboard, mice, and
displays.   So I want the add/del keyboard events, add/del mouse events,
and add/del display events. This is just one use case, I could image
others.  The bottom line is that the current behavior is to broadcast to
everyone all uevents, and I don't see that as correct as it crosses the
network namespace boundaries.  It seems to me that you would want to
provide controls as to  where you want to forward those uevents, and
that is not a policy that I believe should be in the kernel but rather
in user space.

-- 
---Michael J Coss

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/