OpenVZ Forum - RDF feed
type: channel
items: [RFC][patch 0/3] Network container subsystem - bind filtering
items: [RFC][patch 1/3] network container subsystem
items: [RFC][patch 2/3] network security hooks
items: [RFC][patch 3/3] activate filtering for the bind
items: Re: [RFC][patch 1/3] network container subsystem
items: Re: [RFC][patch 0/3] Network container subsystem - bind filtering
items: Re: [RFC][patch 2/3] network security hooks
items: Re: [RFC][patch 3/3] activate filtering for the bind
items: Re: Re: [RFC][patch 3/3] activate filtering for the bind

[RFC][patch 0/3] Network container subsystem - bind filtering
type: item
description: Paul Menage mentionned, a few weeks ago, he wanted a bind filtering for containers. Here it is :) The following patches are a proposition to bring IP isolation to a container. After looking more closely at the code I found that security hooks are at the right place to catch socket calls. The IP isolation relies on the security hooks and that has the advantage of not having the kernel code modified, (expect container.h and makefile/kconfig), the patchset provide just a new file container_network.c Roughly, a container has a subsystem for the network (only ipv4). This subsystem contains the list of the addresses allowed to be used by the container. If a container tries to bind to an address not contained into this list, the bind will fail with EPERM. Of course the bind is allowed to INADDR_ANY. If this approach is ok for everyone, I can extend the bind filtering to consolidate the IP isolation. Regards. -- _______________________________________________ Containers mailing list Containers@lists.linux-foundation.org https://lists.linux-foundation.org/mailman/listinfo/containers
creator: Daniel Lezcano
date: 2007-09-04T17:00:22-00:00

[RFC][patch 1/3] network container subsystem
type: item
description: From: Daniel Lezcano <dlezcano@fr.ibm.com> This patch creates the network container subsystem. It consists for the moment on a single file "network.ipv4". The interface is pretty simple: To add an IP address to the container: echo add AB12FFFF > network.ipv4 To remove this IP address: -------------------------- echo del AB12FFFF > network.ipv4 To list the addresses: ---------------------- cat network.ipv4 The parameter is an IPV4 address in the hexa format. The parsing of a dotted-decimal parameter is totally painful. If this format hurts someone, I can change it to a dotted format at the risk of having something buggy. This patch by itself does nothing more than adding/removing elements from a list. Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com> --- include/linux/container_subsys.h | 4 init/Kconfig | 8 + kernel/Makefile | 1 kernel/container_network.c | 285 +++++++++++++++++++++++++++++++++++++++ 4 files changed, 298 insertions(+) Index: 2.6-mm/include/linux/container_subsys.h =================================================================== --- 2.6-mm.orig/include/linux/container_subsys.h +++ 2.6-mm/include/linux/container_subsys.h @@ -30,3 +30,7 @@ #endif /* */ + +#ifdef CONFIG_CONTAINER_NETWORK +SUBSYS(network) +#endif Index: 2.6-mm/init/Kconfig =================================================================== --- 2.6-mm.orig/init/Kconfig +++ 2.6-mm/init/Kconfig @@ -326,6 +326,14 @@ Provides a simple Resource Controller for monitoring the total CPU consumed by the tasks in a container +config CONTAINER_NETWORK + bool "Network container subsystem" + depends on CONTAINERS && SECURITY_NETWORK + help + Provides a network controller to isolate network traffic + + Say N if unsure + config CPUSETS bool "Cpuset support" depends on SMP && CONTAINERS Index: 2.6-mm/kernel/Makefile =================================================================== --- 2.6-mm.orig/kernel/Makefile +++ 2.6-mm/kernel/Makefile @@ -43,6 +43,7 @@ obj-$(CONFIG_CPUSETS) += cpuset.o obj-$(CO…
creator: Daniel Lezcano
date: 2007-09-04T17:00:23-00:00

[RFC][patch 2/3] network security hooks
type: item
description: From: Daniel Lezcano <dlezcano@fr.ibm.com> After all, the network security hooks are placed exactly at the places we need. This patch plugs the network security hooks with network container subsystem. The hooks always do nothing when they are called from a process running inside the root container. The security hooks are not activated by default when the root container is created, I let the first child container to do that, that ensure correct kernel initialization. Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com> --- kernel/container_network.c | 148 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 148 insertions(+) Index: 2.6-mm/kernel/container_network.c =================================================================== --- 2.6-mm.orig/kernel/container_network.c +++ 2.6-mm/kernel/container_network.c @@ -11,6 +11,7 @@ #include <linux/ctype.h> #include <linux/list.h> #include <linux/spinlock.h> +#include <linux/security.h> struct network { struct container_subsys_state css; @@ -28,12 +29,21 @@ .ipv4_list_lock = __RW_LOCK_UNLOCKED(top_network.ipv4_list_lock), }; +static int security_registered; +static int secondary; + struct container_subsys network_subsys; enum container_filetype { FILE_IPV4, }; +static inline struct network *task_network(struct task_struct *task) +{ + return container_of(task_subsys_state(task, network_subsys_id), + struct network, css); +} + static inline struct network *container_network(struct container *container) { return container_of( @@ -41,6 +51,125 @@ struct network, css); } +static int network_socket_create(int family, int type, int protocol, int kern) +{ + struct network *network; + + network = task_network(current); + if (!network || network == &top_network) + return 0; + + return 0; +} + +static int network_socket_post_create(struct socket *sock, int family, + int type, int protocol, int kern) +{ + struct network *network; + + network = task_network(current); + if (!network || network == &top_network) + return 0; + + …
creator: Daniel Lezcano
date: 2007-09-04T17:00:24-00:00

[RFC][patch 3/3] activate filtering for the bind
type: item
description: From: Daniel Lezcano <dlezcano@fr.ibm.com> For the moment, I only made this patch for the RFC. It shows how simple it is to hook different socket syscalls. This patch denies bind to any addresses which are not in the container IPV4 address list, except for the INADDR_ANY. Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com> --- kernel/container_network.c | 66 +++++++++++++++++++++++---------------------- 1 file changed, 35 insertions(+), 31 deletions(-) Index: 2.6-mm/kernel/container_network.c =================================================================== --- 2.6-mm.orig/kernel/container_network.c +++ 2.6-mm/kernel/container_network.c @@ -12,6 +12,9 @@ #include <linux/list.h> #include <linux/spinlock.h> #include <linux/security.h> +#include <linux/in.h> +#include <linux/net.h> +#include <linux/socket.h> struct network { struct container_subsys_state css; @@ -53,24 +56,14 @@ static int network_socket_create(int family, int type, int protocol, int kern) { - struct network *network; - - network = task_network(current); - if (!network || network == &top_network) - return 0; - + /* nothing to do right now */ return 0; } static int network_socket_post_create(struct socket *sock, int family, int type, int protocol, int kern) { - struct network *network; - - network = task_network(current); - if (!network || network == &top_network) - return 0; - + /* nothing to do right now */ return 0; } @@ -79,47 +72,58 @@ int addrlen) { struct network *network; + struct list_head *l; + rwlock_t *lock; + struct ipv4_list *entry; + __be32 addr; + int ret = -EPERM; + /* Do nothing for the root container */ network = task_network(current); if (!network || network == &top_network) return 0; - return 0; + /* Check we have to do some filtering */ + if (sock->ops->family != AF_INET) + return 0; + + l = &network->ipv4_list; + lock = &network->ipv4_list_lock; + addr = ((struct sockaddr_in *)address)->sin_addr.s_addr; + + if (addr == INADDR_ANY) + return 0; + + read_lock(lock); + list_for_each…
creator: Daniel Lezcano
date: 2007-09-04T17:00:25-00:00

Re: [RFC][patch 1/3] network container subsystem
type: item
description: dlezcano@fr.ibm.com wrote: > From: Daniel Lezcano <dlezcano@fr.ibm.com> > > This patch creates the network container subsystem. > It consists for the moment on a single file "network.ipv4". > > The interface is pretty simple: > > To add an IP address to the container: > > echo add AB12FFFF > network.ipv4 > > To remove this IP address: > -------------------------- > > echo del AB12FFFF > network.ipv4 > > To list the addresses: > ---------------------- > > cat network.ipv4 > > The parameter is an IPV4 address in the hexa format. The parsing of a dotted-decimal > parameter is totally painful. If this format hurts someone, I can change it to a dotted > format at the risk of having something buggy. I think passing ipv4 addresses in hexa form is painful :) Why not use something like this: __be32 addr; unsigned int a, b, c, d; if (sscanf (buffer, "%u.%u.%u.%u", &a, &b, &c, &d) == 4) { if (a < 256 && b < 256 && c < 256 && d < 256) { addr = htonl (a<<24 | b<<16 | c<<8 | d); return 0; } } return -EINVAL; > > This patch by itself does nothing more than adding/removing elements from a list. > > Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com> > > --- > include/linux/container_subsys.h | 4 > init/Kconfig | 8 + > kernel/Makefile | 1 > kernel/container_network.c | 285 +++++++++++++++++++++++++++++++++++++++ > 4 files changed, 298 insertions(+) > > Index: 2.6-mm/include/linux/container_subsys.h > =================================================================== > --- 2.6-mm.orig/include/linux/container_subsys.h > +++ 2.6-mm/include/linux/container_subsys.h > @@ -30,3 +30,7 @@ > #endif > > /* */ > + > +#ifdef CONFIG_CONTAINER_NETWORK > +SUBSYS(network) > +#endif > Index: 2.6-mm/init/Kconfig > =================================================================== > --- 2.6-mm.orig/init/Kconfig > +++ 2.6-mm/init/Kconfig > @@ -326,6 +326,14 @@ > Provides a simple Resource Controller for monitoring the > total CPU consumed by the tasks in a container > > +config CONTAINER_NETWORK > + …
creator: Benjamin Thery
date: 2007-09-05T11:50:13-00:00

Re: [RFC][patch 1/3] network container subsystem
type: item
description: Benjamin Thery wrote: > dlezcano@fr.ibm.com wrote: >> From: Daniel Lezcano <dlezcano@fr.ibm.com> >> >> This patch creates the network container subsystem. It consists for >> the moment on a single file "network.ipv4". >> >> The interface is pretty simple: >> >> To add an IP address to the container: >> >> echo add AB12FFFF > network.ipv4 >> >> To remove this IP address: >> -------------------------- >> >> echo del AB12FFFF > network.ipv4 >> >> To list the addresses: >> ---------------------- >> >> cat network.ipv4 >> >> The parameter is an IPV4 address in the hexa format. The parsing of a >> dotted-decimal >> parameter is totally painful. If this format hurts someone, I can >> change it to a dotted >> format at the risk of having something buggy. > > I think passing ipv4 addresses in hexa form is painful :) > Why not use something like this: > > __be32 addr; > unsigned int a, b, c, d; > > if (sscanf (buffer, "%u.%u.%u.%u", &a, &b, &c, &d) == 4) { > if (a < 256 && b < 256 && c < 256 && d < 256) { > addr = htonl (a<<24 | b<<16 | c<<8 | d); > return 0; > } > } > return -EINVAL; > I didn't think about this format, I will change it. >> >> This patch by itself does nothing more than adding/removing elements >> from a list. >> >> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com> >> >> --- >> include/linux/container_subsys.h | 4 >> init/Kconfig | 8 + >> kernel/Makefile | 1 >> kernel/container_network.c | 285 >> +++++++++++++++++++++++++++++++++++++++ >> 4 files changed, 298 insertions(+) >> >> Index: 2.6-mm/include/linux/container_subsys.h >> =================================================================== >> --- 2.6-mm.orig/include/linux/container_subsys.h >> +++ 2.6-mm/include/linux/container_subsys.h >> @@ -30,3 +30,7 @@ >> #endif >> >> /* */ >> + >> +#ifdef CONFIG_CONTAINER_NETWORK >> +SUBSYS(network) >> +#endif >> Index: 2.6-mm/init/Kconfig >> =================================================================== >> --- 2.6-mm.orig/init/Kconfig >> +++ 2.6-mm/init/Kco…
creator: Daniel Lezcano
date: 2007-09-05T12:43:32-00:00

Re: [RFC][patch 0/3] Network container subsystem - bind filtering
type: item
description: The patchset looks fine to me. This looks like a nice and simple way to obtain basic IP isolation. Benjamin dlezcano@fr.ibm.com wrote: > Paul Menage mentionned, a few weeks ago, he wanted a bind filtering > for containers. Here it is :) > > The following patches are a proposition to bring IP isolation to a container. > > After looking more closely at the code I found that security hooks are > at the right place to catch socket calls. The IP isolation relies on the > security hooks and that has the advantage of not having the kernel code modified, > (expect container.h and makefile/kconfig), the patchset provide just a new > file container_network.c > > Roughly, a container has a subsystem for the network (only ipv4). > This subsystem contains the list of the addresses allowed to be used by the > container. If a container tries to bind to an address not contained into > this list, the bind will fail with EPERM. Of course the bind is allowed to > INADDR_ANY. > > If this approach is ok for everyone, I can extend the bind filtering to > consolidate the IP isolation. > > Regards. > -- B e n j a m i n T h e r y - BULL/DT/Open Software R&D http://www.bull.com _______________________________________________ Containers mailing list Containers@lists.linux-foundation.org https://lists.linux-foundation.org/mailman/listinfo/containers
creator: Benjamin Thery
date: 2007-09-05T14:05:22-00:00

Re: [RFC][patch 0/3] Network container subsystem - bind filtering
type: item
description: Quoting dlezcano@fr.ibm.com (dlezcano@fr.ibm.com): > Paul Menage mentionned, a few weeks ago, he wanted a bind filtering > for containers. Here it is :) > > The following patches are a proposition to bring IP isolation to a container. > > After looking more closely at the code I found that security hooks are > at the right place to catch socket calls. The IP isolation relies on the > security hooks and that has the advantage of not having the kernel code modified, > (expect container.h and makefile/kconfig), the patchset provide just a new > file container_network.c > > Roughly, a container has a subsystem for the network (only ipv4). Just curious - why ipv4 only? When i wrote the bsdjail lsm, using the same approach, doing ipv6 address was pretty simple. Did something change? Or is ipv4 just a temporary restriction while you prototype? > This subsystem contains the list of the addresses allowed to be used by the > container. If a container tries to bind to an address not contained into > this list, the bind will fail with EPERM. Of course the bind is allowed to > INADDR_ANY. > > If this approach is ok for everyone, I can extend the bind filtering to > consolidate the IP isolation. You'll want to cc: the linux-security-module@vger.kernel.org list on this patchset. thanks, -serge _______________________________________________ Containers mailing list Containers@lists.linux-foundation.org https://lists.linux-foundation.org/mailman/listinfo/containers
creator: serue
date: 2007-09-05T15:37:41-00:00

Re: [RFC][patch 0/3] Network container subsystem - bind filtering
type: item
description: Serge E. Hallyn wrote: > Quoting dlezcano@fr.ibm.com (dlezcano@fr.ibm.com): >> Paul Menage mentionned, a few weeks ago, he wanted a bind filtering >> for containers. Here it is :) >> >> The following patches are a proposition to bring IP isolation to a container. >> >> After looking more closely at the code I found that security hooks are >> at the right place to catch socket calls. The IP isolation relies on the >> security hooks and that has the advantage of not having the kernel code modified, >> (expect container.h and makefile/kconfig), the patchset provide just a new >> file container_network.c >> >> Roughly, a container has a subsystem for the network (only ipv4). > > Just curious - why ipv4 only? When i wrote the bsdjail lsm, using the > same approach, doing ipv6 address was pretty simple. Did something > change? Or is ipv4 just a temporary restriction while you prototype? It is a temporary restriction for the prototype. > >> This subsystem contains the list of the addresses allowed to be used by the >> container. If a container tries to bind to an address not contained into >> this list, the bind will fail with EPERM. Of course the bind is allowed to >> INADDR_ANY. >> >> If this approach is ok for everyone, I can extend the bind filtering to >> consolidate the IP isolation. > > You'll want to cc: the linux-security-module@vger.kernel.org list on > this patchset. Sure. > thanks, > -serge > _______________________________________________ Containers mailing list Containers@lists.linux-foundation.org https://lists.linux-foundation.org/mailman/listinfo/containers
creator: Daniel Lezcano
date: 2007-09-05T15:41:03-00:00

Re: [RFC][patch 1/3] network container subsystem
type: item
description: Quoting dlezcano@fr.ibm.com (dlezcano@fr.ibm.com): > From: Daniel Lezcano <dlezcano@fr.ibm.com> > > This patch creates the network container subsystem. > It consists for the moment on a single file "network.ipv4". > > The interface is pretty simple: > > To add an IP address to the container: > > echo add AB12FFFF > network.ipv4 > > To remove this IP address: > -------------------------- > > echo del AB12FFFF > network.ipv4 > > To list the addresses: > ---------------------- > > cat network.ipv4 > > The parameter is an IPV4 address in the hexa format. The parsing of a dotted-decimal > parameter is totally painful. If this format hurts someone, I can change it to a dotted > format at the risk of having something buggy. > > This patch by itself does nothing more than adding/removing elements from a list. > > Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com> > > --- > include/linux/container_subsys.h | 4 > init/Kconfig | 8 + > kernel/Makefile | 1 > kernel/container_network.c | 285 +++++++++++++++++++++++++++++++++++++++ > 4 files changed, 298 insertions(+) > > Index: 2.6-mm/include/linux/container_subsys.h > =================================================================== > --- 2.6-mm.orig/include/linux/container_subsys.h > +++ 2.6-mm/include/linux/container_subsys.h > @@ -30,3 +30,7 @@ > #endif > > /* */ > + > +#ifdef CONFIG_CONTAINER_NETWORK > +SUBSYS(network) > +#endif I think Paul wants the /* */ after your endif as well to reduce patch conflicts. > Index: 2.6-mm/init/Kconfig > =================================================================== > --- 2.6-mm.orig/init/Kconfig > +++ 2.6-mm/init/Kconfig > @@ -326,6 +326,14 @@ > Provides a simple Resource Controller for monitoring the > total CPU consumed by the tasks in a container > > +config CONTAINER_NETWORK > + bool "Network container subsystem" > + depends on CONTAINERS && SECURITY_NETWORK > + help > + Provides a network controller to isolate network traffic > + > + Say N if unsure > + > config CPUSETS > bool…
creator: serue
date: 2007-09-05T15:49:50-00:00

Re: [RFC][patch 2/3] network security hooks
type: item
description: Quoting dlezcano@fr.ibm.com (dlezcano@fr.ibm.com): > From: Daniel Lezcano <dlezcano@fr.ibm.com> > > After all, the network security hooks are placed exactly at the places we need. > This patch plugs the network security hooks with network container subsystem. > > The hooks always do nothing when they are called from a process running inside > the root container. > > The security hooks are not activated by default when the root container is created, > I let the first child container to do that, that ensure correct kernel initialization. > > Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com> > > > --- > kernel/container_network.c | 148 +++++++++++++++++++++++++++++++++++++++++++++ > 1 file changed, 148 insertions(+) > > Index: 2.6-mm/kernel/container_network.c > =================================================================== > --- 2.6-mm.orig/kernel/container_network.c > +++ 2.6-mm/kernel/container_network.c > @@ -11,6 +11,7 @@ > #include <linux/ctype.h> > #include <linux/list.h> > #include <linux/spinlock.h> > +#include <linux/security.h> > > struct network { > struct container_subsys_state css; > @@ -28,12 +29,21 @@ > .ipv4_list_lock = __RW_LOCK_UNLOCKED(top_network.ipv4_list_lock), > }; > > +static int security_registered; > +static int secondary; > + > struct container_subsys network_subsys; > > enum container_filetype { > FILE_IPV4, > }; > > +static inline struct network *task_network(struct task_struct *task) > +{ > + return container_of(task_subsys_state(task, network_subsys_id), > + struct network, css); > +} > + > static inline struct network *container_network(struct container *container) > { > return container_of( > @@ -41,6 +51,125 @@ > struct network, css); > } > > +static int network_socket_create(int family, int type, int protocol, int kern) > +{ > + struct network *network; > + > + network = task_network(current); > + if (!network || network == &top_network) I'm not sure that's the way to go here is it? Maybe you want to allow a CAP_NET_ADMIN proc…
creator: serue
date: 2007-09-05T16:04:08-00:00

Re: [RFC][patch 3/3] activate filtering for the bind
type: item
description: Quoting dlezcano@fr.ibm.com (dlezcano@fr.ibm.com): > From: Daniel Lezcano <dlezcano@fr.ibm.com> > > For the moment, I only made this patch for the RFC. It shows how simple it is > to hook different socket syscalls. This patch denies bind to any addresses > which are not in the container IPV4 address list, except for the INADDR_ANY. > > Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com> > > --- > kernel/container_network.c | 66 +++++++++++++++++++++++---------------------- > 1 file changed, 35 insertions(+), 31 deletions(-) > > Index: 2.6-mm/kernel/container_network.c > =================================================================== > --- 2.6-mm.orig/kernel/container_network.c > +++ 2.6-mm/kernel/container_network.c > @@ -12,6 +12,9 @@ > #include <linux/list.h> > #include <linux/spinlock.h> > #include <linux/security.h> > +#include <linux/in.h> > +#include <linux/net.h> > +#include <linux/socket.h> > > struct network { > struct container_subsys_state css; > @@ -53,24 +56,14 @@ > > static int network_socket_create(int family, int type, int protocol, int kern) > { > - struct network *network; > - > - network = task_network(current); > - if (!network || network == &top_network) > - return 0; > - > + /* nothing to do right now */ > return 0; > } > > static int network_socket_post_create(struct socket *sock, int family, > int type, int protocol, int kern) > { > - struct network *network; > - > - network = task_network(current); > - if (!network || network == &top_network) > - return 0; > - > + /* nothing to do right now */ > return 0; > } > > @@ -79,47 +72,58 @@ Please so send -p diffs. I'll assume this is network_socket_bind() given your patch description :) > int addrlen) > { > struct network *network; > + struct list_head *l; > + rwlock_t *lock; > + struct ipv4_list *entry; > + __be32 addr; > + int ret = -EPERM; > > + /* Do nothing for the root container */ > network = task_network(current); > if (!network || network == &top_network) > return 0; > > - return 0; > …
creator: serue
date: 2007-09-05T16:18:48-00:00

Re: [RFC][patch 3/3] activate filtering for the bind
type: item
description: Serge E. Hallyn wrote: > Quoting dlezcano@fr.ibm.com (dlezcano@fr.ibm.com): >> From: Daniel Lezcano <dlezcano@fr.ibm.com> >> >> For the moment, I only made this patch for the RFC. It shows how simple it is >> to hook different socket syscalls. This patch denies bind to any addresses >> which are not in the container IPV4 address list, except for the INADDR_ANY. >> >> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com> >> >> --- >> kernel/container_network.c | 66 +++++++++++++++++++++++---------------------- >> 1 file changed, 35 insertions(+), 31 deletions(-) >> >> Index: 2.6-mm/kernel/container_network.c >> =================================================================== >> --- 2.6-mm.orig/kernel/container_network.c >> +++ 2.6-mm/kernel/container_network.c >> @@ -12,6 +12,9 @@ >> #include <linux/list.h> >> #include <linux/spinlock.h> >> #include <linux/security.h> >> +#include <linux/in.h> >> +#include <linux/net.h> >> +#include <linux/socket.h> >> >> struct network { >> struct container_subsys_state css; >> @@ -53,24 +56,14 @@ >> >> static int network_socket_create(int family, int type, int protocol, int kern) >> { >> - struct network *network; >> - >> - network = task_network(current); >> - if (!network || network == &top_network) >> - return 0; >> - >> + /* nothing to do right now */ >> return 0; >> } >> >> static int network_socket_post_create(struct socket *sock, int family, >> int type, int protocol, int kern) >> { >> - struct network *network; >> - >> - network = task_network(current); >> - if (!network || network == &top_network) >> - return 0; >> - >> + /* nothing to do right now */ >> return 0; >> } >> >> @@ -79,47 +72,58 @@ > > Please so send -p diffs. I'll assume this is network_socket_bind() > given your patch description :) > >> int addrlen) >> { >> struct network *network; >> + struct list_head *l; >> + rwlock_t *lock; >> + struct ipv4_list *entry; >> + __be32 addr; >> + int ret = -EPERM; >> >> + /* Do nothing for the root container */ >> network …
creator: Daniel Lezcano
date: 2007-09-05T16:38:57-00:00

Re: [RFC][patch 3/3] activate filtering for the bind
type: item
description: Quoting Daniel Lezcano (dlezcano@meiosys.com): > Serge E. Hallyn wrote: >> Quoting dlezcano@fr.ibm.com (dlezcano@fr.ibm.com): >>> From: Daniel Lezcano <dlezcano@fr.ibm.com> >>> >>> For the moment, I only made this patch for the RFC. It shows how simple >>> it is >>> to hook different socket syscalls. This patch denies bind to any >>> addresses >>> which are not in the container IPV4 address list, except for the >>> INADDR_ANY. >>> >>> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com> >>> >>> --- >>> kernel/container_network.c | 66 >>> +++++++++++++++++++++++---------------------- >>> 1 file changed, 35 insertions(+), 31 deletions(-) >>> >>> Index: 2.6-mm/kernel/container_network.c >>> =================================================================== >>> --- 2.6-mm.orig/kernel/container_network.c >>> +++ 2.6-mm/kernel/container_network.c >>> @@ -12,6 +12,9 @@ >>> #include <linux/list.h> >>> #include <linux/spinlock.h> >>> #include <linux/security.h> >>> +#include <linux/in.h> >>> +#include <linux/net.h> >>> +#include <linux/socket.h> >>> >>> struct network { >>> struct container_subsys_state css; >>> @@ -53,24 +56,14 @@ >>> >>> static int network_socket_create(int family, int type, int protocol, int >>> kern) >>> { >>> - struct network *network; >>> - >>> - network = task_network(current); >>> - if (!network || network == &top_network) >>> - return 0; >>> - >>> + /* nothing to do right now */ >>> return 0; >>> } >>> >>> static int network_socket_post_create(struct socket *sock, int family, >>> int type, int protocol, int kern) >>> { >>> - struct network *network; >>> - >>> - network = task_network(current); >>> - if (!network || network == &top_network) >>> - return 0; >>> - >>> + /* nothing to do right now */ >>> return 0; >>> } >>> >>> @@ -79,47 +72,58 @@ >> Please so send -p diffs. I'll assume this is network_socket_bind() >> given your patch description :) >>> int addrlen) >>> { >>> struct network *network; >>> + struct list_head *l; >>> + rwlock_t *lock; >>>…
creator: serue
date: 2007-09-10T13:23:30-00:00

Re: [RFC][patch 3/3] activate filtering for the bind
type: item
description: Serge E. Hallyn wrote: > Quoting Daniel Lezcano (dlezcano@meiosys.com): >> Serge E. Hallyn wrote: >>> Quoting dlezcano@fr.ibm.com (dlezcano@fr.ibm.com): >>>> From: Daniel Lezcano <dlezcano@fr.ibm.com> >>>> >>>> For the moment, I only made this patch for the RFC. It shows how simple >>>> it is >>>> to hook different socket syscalls. This patch denies bind to any >>>> addresses >>>> which are not in the container IPV4 address list, except for the >>>> INADDR_ANY. >>>> >>>> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com> >>>> >>>> --- >>>> kernel/container_network.c | 66 >>>> +++++++++++++++++++++++---------------------- >>>> 1 file changed, 35 insertions(+), 31 deletions(-) >>>> >>>> Index: 2.6-mm/kernel/container_network.c >>>> =================================================================== >>>> --- 2.6-mm.orig/kernel/container_network.c >>>> +++ 2.6-mm/kernel/container_network.c >>>> @@ -12,6 +12,9 @@ >>>> #include <linux/list.h> >>>> #include <linux/spinlock.h> >>>> #include <linux/security.h> >>>> +#include <linux/in.h> >>>> +#include <linux/net.h> >>>> +#include <linux/socket.h> >>>> >>>> struct network { >>>> struct container_subsys_state css; >>>> @@ -53,24 +56,14 @@ >>>> >>>> static int network_socket_create(int family, int type, int protocol, int >>>> kern) >>>> { >>>> - struct network *network; >>>> - >>>> - network = task_network(current); >>>> - if (!network || network == &top_network) >>>> - return 0; >>>> - >>>> + /* nothing to do right now */ >>>> return 0; >>>> } >>>> >>>> static int network_socket_post_create(struct socket *sock, int family, >>>> int type, int protocol, int kern) >>>> { >>>> - struct network *network; >>>> - >>>> - network = task_network(current); >>>> - if (!network || network == &top_network) >>>> - return 0; >>>> - >>>> + /* nothing to do right now */ >>>> return 0; >>>> } >>>> >>>> @@ -79,47 +72,58 @@ >>> Please so send -p diffs. I'll assume this is network_socket_bind() >>> given your patch description :) >>>> int addrlen…
creator: Daniel Lezcano
date: 2007-09-10T13:52:17-00:00

Re: [RFC][patch 3/3] activate filtering for the bind
type: item
description: Quoting Daniel Lezcano (dlezcano@fr.ibm.com): > Serge E. Hallyn wrote: >> Quoting Daniel Lezcano (dlezcano@meiosys.com): >>> Serge E. Hallyn wrote: >>>> Quoting dlezcano@fr.ibm.com (dlezcano@fr.ibm.com): >>>>> From: Daniel Lezcano <dlezcano@fr.ibm.com> >>>>> >>>>> For the moment, I only made this patch for the RFC. It shows how simple >>>>> it is >>>>> to hook different socket syscalls. This patch denies bind to any >>>>> addresses >>>>> which are not in the container IPV4 address list, except for the >>>>> INADDR_ANY. >>>>> >>>>> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com> >>>>> >>>>> --- >>>>> kernel/container_network.c | 66 >>>>> +++++++++++++++++++++++---------------------- >>>>> 1 file changed, 35 insertions(+), 31 deletions(-) >>>>> >>>>> Index: 2.6-mm/kernel/container_network.c >>>>> =================================================================== >>>>> --- 2.6-mm.orig/kernel/container_network.c >>>>> +++ 2.6-mm/kernel/container_network.c >>>>> @@ -12,6 +12,9 @@ >>>>> #include <linux/list.h> >>>>> #include <linux/spinlock.h> >>>>> #include <linux/security.h> >>>>> +#include <linux/in.h> >>>>> +#include <linux/net.h> >>>>> +#include <linux/socket.h> >>>>> >>>>> struct network { >>>>> struct container_subsys_state css; >>>>> @@ -53,24 +56,14 @@ >>>>> >>>>> static int network_socket_create(int family, int type, int protocol, >>>>> int kern) >>>>> { >>>>> - struct network *network; >>>>> - >>>>> - network = task_network(current); >>>>> - if (!network || network == &top_network) >>>>> - return 0; >>>>> - >>>>> + /* nothing to do right now */ >>>>> return 0; >>>>> } >>>>> >>>>> static int network_socket_post_create(struct socket *sock, int family, >>>>> int type, int protocol, int kern) >>>>> { >>>>> - struct network *network; >>>>> - >>>>> - network = task_network(current); >>>>> - if (!network || network == &top_network) >>>>> - return 0; >>>>> - >>>>> + /* nothing to do right now */ >>>>> return 0; >>>>> } >>>>> >>>>> @@ -79,47 +72,58 @@ >>>> Please s…
creator: serue
date: 2007-09-10T15:46:30-00:00

Re: Re: [RFC][patch 3/3] activate filtering for the bind
type: item
description: On 9/10/07, Serge E. Hallyn <serue@us.ibm.com> wrote: > > The only downside I see right now is what to do about a sendto() on a > udp socket that hasn't been bound. Maybe have additional chains in the new iptable called "sendto" and "recvfrom" that are invoked for those operations on unbound datagram sockets? Paul _______________________________________________ Containers mailing list Containers@lists.linux-foundation.org https://lists.linux-foundation.org/mailman/listinfo/containers
creator: Paul Menage
date: 2007-09-10T17:49:55-00:00

Re: Re: [RFC][patch 3/3] activate filtering for the bind
type: item
description: Quoting Paul Menage (menage@google.com): > On 9/10/07, Serge E. Hallyn <serue@us.ibm.com> wrote: > > > > The only downside I see right now is what to do about a sendto() on a > > udp socket that hasn't been bound. > > Maybe have additional chains in the new iptable called "sendto" and > "recvfrom" that are invoked for those operations on unbound datagram > sockets? Yup. Perhaps the biggest upside of this approach is that it's providing network functionality in a way that should be much more familiar to network folks. As opposed to using an lsm with a new vfs interface. Is anyone working on this implementation, for comparison to the lsm patch? -serge _______________________________________________ Containers mailing list Containers@lists.linux-foundation.org https://lists.linux-foundation.org/mailman/listinfo/containers
creator: serue
date: 2007-09-10T18:11:31-00:00

Re: Re: [RFC][patch 3/3] activate filtering for the bind
type: item
description: On 9/10/07, Serge E. Hallyn <serue@us.ibm.com> wrote: > > Perhaps the biggest upside of this approach is that it's providing > network functionality in a way that should be much more familiar to > network folks. As opposed to using an lsm with a new vfs interface. Right - one of the things that I promised at the kernel summit was that we'd be very careful about introducing random new userspace APIs as part of control files. Reusing existing APIs where practical is way nicer. > > Is anyone working on this implementation, for comparison to the lsm > patch? Eric may be; if not then it's something I'd be interested in doing but probably won't have time for, for a couple of weeks at least. So if someone else wanted to play with it in the meantime that would be great. Paul _______________________________________________ Containers mailing list Containers@lists.linux-foundation.org https://lists.linux-foundation.org/mailman/listinfo/containers
creator: Paul Menage
date: 2007-09-10T18:15:19-00:00