a6c6796c71
The flow classifier can use uids and gids of the sockets that are transmitting packets and do insert those uids and gids into the packet classification calcuation. I don't fully understand the details but it appears that we can depend on specific uids and gids when making traffic classification decisions. To work with user namespaces enabled map from kuids and kgids into uids and gids in the initial user namespace giving raw integer values the code can play with and depend on. To avoid issues of userspace depending on uids and gids in packet classifiers installed from other user namespaces and getting confused deny all packet classifiers that use uids or gids that are not comming from a netlink socket in the initial user namespace. Cc: Patrick McHardy <kaber@trash.net> Cc: Eric Dumazet <eric.dumazet@gmail.com> Cc: Jamal Hadi Salim <jhs@mojatatu.com> Cc: Changli Gao <xiaosuo@gmail.com> Acked-by: David S. Miller <davem@davemloft.net> Acked-by: Serge Hallyn <serge.hallyn@canonical.com> Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> |
||
|---|---|---|
| .. | ||
| calibrate.c | ||
| do_mounts_initrd.c | ||
| do_mounts_md.c | ||
| do_mounts_rd.c | ||
| do_mounts.c | ||
| do_mounts.h | ||
| init_task.c | ||
| initramfs.c | ||
| Kconfig | ||
| main.c | ||
| Makefile | ||
| noinitramfs.c | ||
| version.c | ||