netdev - Re: [PATCH] netns: unix: only allow to find out unix socket in same net namespace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 21 Aug 2013 03:42:02 -0700
From:	ebiederm@...ssion.com (Eric W. Biederman)
To:	Gao feng <gaofeng@...fujitsu.com>
Cc:	netdev@...r.kernel.org, systemd-devel@...ts.freedesktop.org,
	lxc-devel@...ts.sourceforge.net, davem@...emloft.net,
	Linux Containers <containers@...ts.linux-foundation.org>,
	"libvir-list\@redhat.com" <libvir-list@...hat.com>
Subject: Re: [PATCH] netns: unix: only allow to find out unix socket in same net namespace

Gao feng <gaofeng@...fujitsu.com> writes:

> right now I only take note of the unix socket /run/systemd/private,
> but there may have many similar unix sockets, they can exist in any
> path. the strange problems will still happen.

It could just as easily have been a fifo in the filesystem, and the
result would have been the same.

The network namespace are all about communicating between network
namespaces and that is what was allowed here.

If you don't want a socket or a fifo or any other file to be used by a
container don't give it access to it.  It really is that simple.

Eric
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html