Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754676AbdLFDPZ (ORCPT ); Tue, 5 Dec 2017 22:15:25 -0500 Received: from mail-qt0-f178.google.com ([209.85.216.178]:36779 "EHLO mail-qt0-f178.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754345AbdLFDPV (ORCPT ); Tue, 5 Dec 2017 22:15:21 -0500 X-Google-Smtp-Source: AGs4zMaIvJZ6ouQp0NG5HOT0HDVPAX8hR0bx9BD6DFdQGdKChjU3ua0hEHu3kB0h8JTkIGmpx8M5Xg== MIME-Version: 1.0 In-Reply-To: References: <1512513982-20407-1-git-send-email-cernekee@chromium.org> From: Kevin Cernekee Date: Tue, 5 Dec 2017 19:14:59 -0800 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: [PATCH] netlink: Add netns check on taps To: David Ahern Cc: davem@davemloft.net, "Berg, Johannes" , netdev@vger.kernel.org, linux-kernel@vger.kernel.org Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 433 Lines: 10 On Tue, Dec 5, 2017 at 6:19 PM, David Ahern wrote: >> + if (!net_eq(dev_net(dev), sock_net(sk)) && >> + !net_eq(dev_net(dev), &init_net)) { > > Why is init_net special? Seems like snooping should be limited to the > namespace you are in. Depends how important it is to preserve the current "typical use case" behavior, where the root user in the init netns can see all netlink traffic on the system.