linux-kernel - Re: [PATCH] netlink: Add netns check on taps

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 5 Dec 2017 19:14:59 -0800
From:   Kevin Cernekee <cernekee@...omium.org>
To:     David Ahern <dsahern@...il.com>
Cc:     davem@...emloft.net, "Berg, Johannes" <johannes.berg@...el.com>,
        netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] netlink: Add netns check on taps

On Tue, Dec 5, 2017 at 6:19 PM, David Ahern <dsahern@...il.com> wrote:
>> +     if (!net_eq(dev_net(dev), sock_net(sk)) &&
>> +         !net_eq(dev_net(dev), &init_net)) {
>
> Why is init_net special? Seems like snooping should be limited to the
> namespace you are in.

Depends how important it is to preserve the current "typical use case"
behavior, where the root user in the init netns can see all netlink
traffic on the system.