netdev - Re: [PATCH] ipv6: make the net.ipv6.conf.all.use_tempaddr sysctl propagate to interface settings

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CACfMzvqtRTeFy0Q8yt-e9B5ndrBsNmhQ4q12LBndTrdyMfYnLg@mail.gmail.com>
Date:	Mon, 19 Dec 2011 21:04:15 -0500
From:	Mathieu Trudel-Lapierre <mathieu-tl@...ntu.com>
To:	David Miller <davem@...emloft.net>
Cc:	mathieu.trudel-lapierre@...onical.com, netdev@...r.kernel.org,
	kuznet@....inr.ac.ru, jmorris@...ei.org, yoshfuji@...ux-ipv6.org,
	kaber@...sh.net
Subject: Re: [PATCH] ipv6: make the net.ipv6.conf.all.use_tempaddr sysctl
 propagate to interface settings

On Mon, Dec 19, 2011 at 4:16 PM, David Miller <davem@...emloft.net> wrote:
> "all" settings must be in place before the device is created and comes up.
>
> You can't just "propagate" to the existing devices when the "all"
> setting is changed, because an individual device might have had it's
> independent sysctl setting modified by the administrator and you'll be
> smashing that.
>
> I'm not applying this patch.

Would it be possible in this case to update the documentation to make
this clear? I'm certainly not the only one who has come up with the
question. What seems to come up often is confusion between the purpose
of "default" and that of "all". My understanding really was that
*default* is meant to be set before the devices are created and come
up.

I believe use_tempaddr is a special case in which if you want to
enable it, you'll likely want to have it set globally; at least that
seems the case for mobile systems where this appears to me as making
the most sense. Distributions may want to set a defaut for
installations being that temporary addresses are enabled by default,
which tends to be very impractical to do any other way (interfaces
don't all come up at the same time; on my system at least eth0 comes
up very early, before sysctls can be applied in userland). Dealing
with this particular issue at the distribution level, you can't know
in advance what interfaces are on the system. It seems as though
setting:

net.ipv6.conf.all.use_tempaddr=2
net.ipv6.conf.default.use_tempaddr=2

Should be sufficient to enable privacy addresses everywhere, at boot.
This wouldn't be particularly different from disabling ipv6 with the
sysctls, I think.

Besides the issue of smashing settings applied by administrators, is
there something else I'm missing?

Kind regards,

Mathieu Trudel-Lapierre <mathieu-tl@...ntu.com>
Freenode: cyphermox, Jabber: mathieu.tl@...il.com
4096R/EE018C93 1967 8F7D 03A1 8F38 732E  FF82 C126 33E1 EE01 8C93
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html