lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-Id: <20220923133820.993725-1-michael.weiss@aisec.fraunhofer.de> Date: Fri, 23 Sep 2022 15:38:18 +0200 From: Michael Weiß <michael.weiss@...ec.fraunhofer.de> To: Paolo Abeni <pabeni@...hat.com>, Pravin B Shelar <pshelar@....org>, "David S . Miller" <davem@...emloft.net>, Jakub Kicinski <kuba@...nel.org> Cc: Joe Stringer <joe@...ium.io>, Andy Zhou <azhou@....org>, Michael Weiß <michael.weiss@...ec.fraunhofer.de>, Eric Dumazet <edumazet@...gle.com>, netdev@...r.kernel.org, dev@...nvswitch.org, linux-kernel@...r.kernel.org Subject: [PATCH v3 net-next 0/2] net: openvswitch: metering and conntrack in userns Currently using openvswitch in a non-initial user namespace, e.g., an unprivileged container, is possible but without metering and conntrack support. This is due to the restriction of the corresponding Netlink interfaces to the global CAP_NET_ADMIN. This simple patches switch from GENL_ADMIN_PERM to GENL_UNS_ADMIN_PERM in several cases to allow this also for the unprivileged container use case. We tested this for unprivileged containers created by the container manager of GyroidOS (gyroidos.github.io). However, for other container managers such as LXC or systemd which provide unprivileged containers this should be apply equally. Changes in v3: - also changed GFP_KERNEL to GFP_KERNEL_ACCOUNT in ovs_ct_limit_set_zone_limit() as suggested by Jakub - Rebased on net-next/main branch of networking tree Changes in v2: - changed GFP_KERNEL to GFP_KERNEL_ACCOUNT in dp_meter_create() as suggested by Paolo - Rebased on net branch of networking tree Michael Weiß (2): net: openvswitch: allow metering in non-initial user namespace net: openvswitch: allow conntrack in non-initial user namespace net/openvswitch/conntrack.c | 13 ++++++++----- net/openvswitch/meter.c | 14 +++++++------- 2 files changed, 15 insertions(+), 12 deletions(-) base-commit: 3aba35bb201fd2481b3fd5794120d9d1b0734fe8 -- 2.30.2
Powered by blists - more mailing lists