• E
    userns: Convert cls_flow to work with user namespaces enabled · a6c6796c
    Eric W. Biederman 提交于
    The flow classifier can use uids and gids of the sockets that
    are transmitting packets and do insert those uids and gids
    into the packet classification calcuation.  I don't fully
    understand the details but it appears that we can depend
    on specific uids and gids when making traffic classification
    decisions.
    
    To work with user namespaces enabled map from kuids and kgids
    into uids and gids in the initial user namespace giving raw
    integer values the code can play with and depend on.
    
    To avoid issues of userspace depending on uids and gids in
    packet classifiers installed from other user namespaces
    and getting confused deny all packet classifiers that
    use uids or gids that are not comming from a netlink socket
    in the initial user namespace.
    
    Cc: Patrick McHardy <kaber@trash.net>
    Cc: Eric Dumazet <eric.dumazet@gmail.com>
    Cc: Jamal Hadi Salim <jhs@mojatatu.com>
    Cc: Changli Gao <xiaosuo@gmail.com>
    Acked-by: NDavid S. Miller <davem@davemloft.net>
    Acked-by: NSerge Hallyn <serge.hallyn@canonical.com>
    Signed-off-by: NEric W. Biederman <ebiederm@xmission.com>
    a6c6796c
Kconfig 51.0 KB