netdev - Re: [PATCH v3 net] inet_diag: add cgroup id attribute

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 3 Apr 2020 17:37:17 +0300
From:   Konstantin Khlebnikov <khlebnikov@...dex-team.ru>
To:     Tejun Heo <tj@...nel.org>, Dmitry Yakunin <zeil@...dex-team.ru>
Cc:     davem@...emloft.net, netdev@...r.kernel.org,
        cgroups@...r.kernel.org, bpf@...r.kernel.org
Subject: Re: [PATCH v3 net] inet_diag: add cgroup id attribute

On 03/04/2020 16.38, Tejun Heo wrote:
> On Fri, Apr 03, 2020 at 12:56:27PM +0300, Dmitry Yakunin wrote:
>> This patch adds cgroup v2 ID to common inet diag message attributes.
>> Cgroup v2 ID is kernfs ID (ino or ino+gen). This attribute allows filter
>> inet diag output by cgroup ID obtained by name_to_handle_at() syscall.
>> When net_cls or net_prio cgroup is activated this ID is equal to 1 (root
>> cgroup ID) for newly created sockets.
>>
>> Some notes about this ID:
>>
>> 1) gets initialized in socket() syscall
>> 2) incoming socket gets ID from listening socket
>>     (not during accept() syscall)
> 
> How would this work with things like inetd? Would it make sense to associate the
> socket on the first actual send/recv?

First send/recv seems too intrusive.
Setsockopt to change association to current cgroup (or by id) seems more reasonable.

Systemd variant of inetd handles sockets as separate units and probably
creates own cgroups for them.

> 
> Thanks.
>