netdev - Re: [PATCH 00/12] add namespace support for netfilter protos

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 17 Apr 2012 12:59:00 +0200
From:	Pablo Neira Ayuso <pablo@...filter.org>
To:	Jan Engelhardt <jengelh@...ozas.de>
Cc:	Gao feng <gaofeng@...fujitsu.com>, netfilter-devel@...r.kernel.org,
	netdev@...r.kernel.org, ebiederm@...ssion.com,
	serge.hallyn@...onical.com, dlezcano@...ibm.com
Subject: Re: [PATCH 00/12] add namespace support for netfilter protos

On Tue, Apr 17, 2012 at 12:34:48PM +0200, Jan Engelhardt wrote:
> 
> On Tuesday 2012-04-17 04:56, Gao feng wrote:
> 
> >Currently the sysctl of netfilter proto is not isolated, so when 
> >changing proto's sysctl in container will cause the host's sysctl 
> >be changed too. it's not expected.
> 
> I wonder if it made sense to do the configuration of NFCT via
> netlink as well, and deprecate the sysctl interface.

Good point Jan.

However, we're in inconsistent state now and removing interfaces is
not easy / fast.

So I think we have to fix it first and then, if we decide to do so,
deprecate them.

It seems to me like a good idea to target to providing netlink
interfaces for all netfilter tweaks and use iptables (or whatsoever.
command line tool we'll have in the future) to attach specific
configurations to flow.

Thus, having no more sysctl stuff and module parameters tweaks.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html