OpenVZ Forum: Devel » Re: [patch 2/6] [Network namespace] Network device sharing by view

Home » Mailing lists » Devel » Re: [patch 2/6] [Network namespace] Network device sharing by view

Show: Today's Messages :: Show Polls :: Message Navigator
E-mail to friend

Re: strict isolation of net interfaces [message #4178 is a reply to message #4174]

Fri, 30 June 2006 17:41

ebiederm
Messages: 1354
Registered: February 2006

Senior Member

"Serge E. Hallyn" <serue@us.ibm.com> writes:

> Quoting Eric W. Biederman (ebiederm@xmission.com):
>> This whole debate on network devices show up in multiple network namespaces
>> is just silly. The only reason for wanting that appears to be better
> management.
>
> A damned good reason.

Better management is a good reason. But constructing the management in
a way that hampers the implementation and confuses existing applications is
a problem.

Things are much easier if namespaces are completely independent.

Among other things the semantics are clear and obvious.

> Clearly we want the parent namespace to be able
> to control what the child can do. So whatever interface a child gets,
> the parent should be able to somehow address. Simple iptables rules
> controlling traffic between it's own netdevice and the one it hands it's
> children seem a good option.

That or we setup the child and then drop CAP_NET_ADMIN.

>> We have deeper issues like can we do a reasonable implementation without a
>> network device showing up in multiple namespaces.
>
> Isn't that the same issue?

I guess I was thinking from the performance and cleanliness point of
view.

>> If we can get layer 2 level isolation working without measurable overhead
>> with one namespace per device it may be worth revisiting things. Until
>> then it is a side issue at best.
>
> Ok, and in the meantime we can all use the network part of the bsdjail
> lsm? :)

If necessary. But mostly we concentrate on the fundamentals and figure
out what it takes to take the level 2 stuff working.

Eric

Report message to a moderator

[Message index]

		Re: [patch 2/6] [Network namespace] Network device sharing by view By: Andrey Savochkin on Tue, 27 June 2006 09:38
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: Daniel Lezcano on Tue, 27 June 2006 11:21
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: ebiederm on Tue, 27 June 2006 11:52
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: Herbert Poetzl on Tue, 27 June 2006 16:02
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: ebiederm on Tue, 27 June 2006 16:47
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: Ben Greear on Tue, 27 June 2006 17:19
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: Herbert Poetzl on Tue, 27 June 2006 22:52
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: Dave Hansen on Tue, 27 June 2006 23:12
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: Alexey Kuznetsov on Tue, 27 June 2006 23:42
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: ebiederm on Wed, 28 June 2006 03:38
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: Herbert Poetzl on Wed, 28 June 2006 13:36
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: ebiederm on Wed, 28 June 2006 14:21
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: jamal on Wed, 28 June 2006 13:53
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: Sam Vilain on Thu, 29 June 2006 21:07
		strict isolation of net interfaces By: Cedric Le Goater on Thu, 29 June 2006 22:14
		Re: strict isolation of net interfaces By: Sam Vilain on Fri, 30 June 2006 02:48
		Re: strict isolation of net interfaces By: Andrey Savochkin on Mon, 03 July 2006 14:53
		Re: strict isolation of net interfaces By: Sam Vilain on Tue, 04 July 2006 03:00
		Re: strict isolation of net interfaces By: Daniel Lezcano on Tue, 04 July 2006 12:29
		Re: strict isolation of net interfaces By: serue on Fri, 30 June 2006 02:39
		Re: strict isolation of net interfaces By: Cedric Le Goater on Fri, 30 June 2006 08:56
		Re: strict isolation of net interfaces By: Herbert Poetzl on Mon, 03 July 2006 13:36
		Re: strict isolation of net interfaces By: Daniel Lezcano on Fri, 30 June 2006 12:23
		Re: strict isolation of net interfaces By: ebiederm on Fri, 30 June 2006 14:20
		Re: strict isolation of net interfaces By: Daniel Lezcano on Fri, 30 June 2006 15:22
		Re: strict isolation of net interfaces By: ebiederm on Fri, 30 June 2006 17:58
		Re: strict isolation of net interfaces By: serue on Fri, 30 June 2006 16:14
		Re: strict isolation of net interfaces By: ebiederm on Fri, 30 June 2006 17:41
		Re: strict isolation of net interfaces By: ebiederm on Fri, 30 June 2006 18:09
		Re: strict isolation of net interfaces By: Sam Vilain on Tue, 04 July 2006 13:13
		Re: strict isolation of net interfaces By: Daniel Lezcano on Tue, 04 July 2006 13:19
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: jamal on Fri, 30 June 2006 00:15
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: Herbert Poetzl on Fri, 30 June 2006 03:35
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: Andrey Savochkin on Fri, 30 June 2006 07:45
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: jamal on Fri, 30 June 2006 13:50
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: Andrey Savochkin on Fri, 30 June 2006 15:01
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: ebiederm on Fri, 30 June 2006 18:22
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: jamal on Fri, 30 June 2006 21:51
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: ebiederm on Sat, 01 July 2006 00:50
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: ebiederm on Wed, 28 June 2006 14:51
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: Alexey Kuznetsov on Tue, 27 June 2006 16:49
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: Andrey Savochkin on Tue, 27 June 2006 11:55

Previous Topic:	Re: [Vserver] Re: Container Test Campaign
Next Topic:	porting stable patch to higher kernel versions

Goto Forum:

-=] Back to Top [=-

[ Syndicate this forum (XML) ] [

] [

]

Current Time: Sat Aug 02 16:19:37 GMT 2025

Total time taken to generate the page: 0.79976 seconds