OpenVZ Forum: Devel » [RFC] network namespaces

Home » Mailing lists » Devel » [RFC] network namespaces

Show: Today's Messages :: Show Polls :: Message Navigator
E-mail to friend

Re: Re: [RFC] network namespaces [message #6130 is a reply to message #6113]

Fri, 08 September 2006 18:11

Herbert Poetzl
Messages: 239
Registered: February 2006

Senior Member

On Fri, Sep 08, 2006 at 05:10:08PM +0400, Dmitry Mishin wrote:
> On Thursday 07 September 2006 21:27, Herbert Poetzl wrote:
> > well, who said that you need to have things like RAW sockets
> > or other protocols except IP, not to speak of iptable and
> > routing entries ...
> >
> > folks who _want_ full network virtualization can use the
> > more complete virtual setup and be happy ...

> Let's think about how to implement this.

> As I understood VServer's design, your proposal is to split
> CAP_NET_ADMIN to multiple capabilities and use them if required. So,
> for your light-weight container it is enough to implement context
> isolation for protected by CAP_NET_IP capability (for example) code
> and put 'if (!capable(CAP_NET_*))' checks to all other places.

actually the light-weight ip isolation runs perfectly
fine _without_ CAP_NET_ADMIN, as you do not want the
guest to be able to mess with the 'configured' ips at
all (not to speak of interfaces here)

best,
Herbert

> But this could be easily implemented over OpenVZ code by
> CAP_VE_NET_ADMIN split.
>
> So, the question is:
> Could you point out the places in Andrey's implementation of network
> namespaces, which prevents you to add CAP_NET_ADMIN separation later?
>
> --
> Thanks,
> Dmitry.

Report message to a moderator

[Message index]

		[RFC] network namespaces By: Andrey Savochkin on Tue, 15 August 2006 14:20
		[PATCH 1/9] network namespaces: core and device list By: Andrey Savochkin on Tue, 15 August 2006 14:48
		Re: [PATCH 1/9] network namespaces: core and device list By: Dave Hansen on Wed, 16 August 2006 14:46
		Re: [PATCH 1/9] network namespaces: core and device list By: Stephen Hemminger on Wed, 16 August 2006 16:45
		[PATCH 2/9] network namespaces: IPv4 routing By: Andrey Savochkin on Tue, 15 August 2006 14:48
		[PATCH 6/9] allow proc_dir_entries to have destructor By: Andrey Savochkin on Tue, 15 August 2006 14:48
		[PATCH 5/9] network namespaces: async socket operations By: Andrey Savochkin on Tue, 15 August 2006 14:48
		Re: [PATCH 5/9] network namespaces: async socket operations By: Daniel Lezcano on Fri, 22 September 2006 15:33
		Re: [PATCH 5/9] network namespaces: async socket operations By: Andrey Savochkin on Sat, 23 September 2006 13:16
		[PATCH 7/9] net_device seq_file By: Andrey Savochkin on Tue, 15 August 2006 14:48
		[PATCH 8/9] network namespaces: device to pass packets between namespaces By: Andrey Savochkin on Tue, 15 August 2006 14:48
		[PATCH 4/9] network namespaces: socket hashes By: Andrey Savochkin on Tue, 15 August 2006 14:48
		Re: [PATCH 4/9] network namespaces: socket hashes By: Daniel Lezcano on Mon, 18 September 2006 15:12
		Re: [PATCH 4/9] network namespaces: socket hashes By: Andrey Savochkin on Wed, 20 September 2006 16:32
		Re: [PATCH 4/9] network namespaces: socket hashes By: Daniel Lezcano on Thu, 21 September 2006 12:34
		[PATCH 9/9] network namespaces: playing with pass-through device By: Andrey Savochkin on Tue, 15 August 2006 14:48
		Re: [RFC] network namespaces By: serue on Wed, 16 August 2006 11:53
		Re: [RFC] network namespaces By: Alexey Kuznetsov on Wed, 16 August 2006 15:12
		Re: [RFC] network namespaces By: ebiederm on Wed, 16 August 2006 17:35
		Re: [RFC] network namespaces By: dev on Thu, 17 August 2006 08:28
		Re: [RFC] network namespaces By: Daniel Lezcano on Tue, 05 September 2006 13:34
		Re: [RFC] network namespaces By: ebiederm on Tue, 05 September 2006 14:45
		Re: [RFC] network namespaces By: Herbert Poetzl on Tue, 05 September 2006 16:53
		Re: [RFC] network namespaces By: Daniel Lezcano on Wed, 06 September 2006 09:10
		Re: [RFC] network namespaces By: Herbert Poetzl on Wed, 06 September 2006 16:56
		Re: Re: [RFC] network namespaces By: kir on Wed, 06 September 2006 17:36
		Re: [RFC] network namespaces By: ebiederm on Wed, 06 September 2006 18:34
		Re: [RFC] network namespaces By: kir on Wed, 06 September 2006 18:56
		Re: [RFC] network namespaces By: Cedric Le Goater on Wed, 06 September 2006 20:53
		RE: [RFC] network namespaces By: Caitlin Bestler on Wed, 06 September 2006 23:06
		Re: [RFC] network namespaces By: Daniel Lezcano on Thu, 07 September 2006 08:25
		Re: [RFC] network namespaces By: ebiederm on Thu, 07 September 2006 18:29
		Re: [RFC] network namespaces By: Herbert Poetzl on Fri, 08 September 2006 06:02
		Re: Re: [RFC] network namespaces By: dev on Thu, 07 September 2006 16:20
		Re: Re: [RFC] network namespaces By: Herbert Poetzl on Thu, 07 September 2006 17:27
		Re: Re: [RFC] network namespaces By: Mishin Dmitry on Fri, 08 September 2006 13:10
		Re: Re: [RFC] network namespaces By: Herbert Poetzl on Fri, 08 September 2006 18:11
		Re: Re: [RFC] network namespaces By: Mishin Dmitry on Sat, 09 September 2006 07:57
		Re: Re: [RFC] network namespaces By: Herbert Poetzl on Sun, 10 September 2006 02:47
		Re: Re: [RFC] network namespaces By: Mishin Dmitry on Sun, 10 September 2006 07:45
		Re: Re: [RFC] network namespaces By: Herbert Poetzl on Sun, 10 September 2006 19:22
		Re: [RFC] network namespaces By: ebiederm on Tue, 12 September 2006 03:26
		Re: Re: [RFC] network namespaces By: ebiederm on Sun, 10 September 2006 03:41
		Re: Re: [RFC] network namespaces By: Mishin Dmitry on Sun, 10 September 2006 08:11
		Re: Re: [RFC] network namespaces By: Herbert Poetzl on Sun, 10 September 2006 19:19
		Re: Re: [RFC] network namespaces By: Daniel Lezcano on Mon, 11 September 2006 14:40
		Re: Re: [RFC] network namespaces By: Herbert Poetzl on Mon, 11 September 2006 14:57
		Re: Re: [RFC] network namespaces By: Daniel Lezcano on Mon, 11 September 2006 15:04
		Re: Re: [RFC] network namespaces By: Mishin Dmitry on Mon, 11 September 2006 15:10
		Re: [RFC] network namespaces By: ebiederm on Tue, 12 September 2006 03:28
		Re: [RFC] network namespaces By: Mishin Dmitry on Tue, 12 September 2006 07:38
		Re: Re: [RFC] network namespaces By: ebiederm on Thu, 07 September 2006 19:50
		Re: Re: [RFC] network namespaces By: Daniel Lezcano on Wed, 06 September 2006 21:44
		Re: [RFC] network namespaces By: ebiederm on Wed, 06 September 2006 17:58
		Re: [RFC] network namespaces By: ebiederm on Tue, 05 September 2006 18:27
		Re: [RFC] network namespaces By: dev on Wed, 06 September 2006 14:52
		Re: [RFC] network namespaces By: Daniel Lezcano on Tue, 05 September 2006 15:32
		Re: [RFC] network namespaces By: dev on Tue, 05 September 2006 15:44
		Re: [RFC] network namespaces By: ebiederm on Tue, 05 September 2006 17:09
		Re: [RFC] network namespaces By: Cedric Le Goater on Wed, 06 September 2006 20:25
		Re: Re: [RFC] network namespaces By: kir on Wed, 06 September 2006 15:09
		Re: [RFC] network namespaces By: ebiederm on Wed, 06 September 2006 20:40
		Re: [RFC] network namespaces By: ebiederm on Wed, 06 September 2006 23:25
		Re: [RFC] network namespaces By: Stephen Hemminger on Thu, 07 September 2006 00:53
		Re: [RFC] network namespaces By: ebiederm on Thu, 07 September 2006 05:11
		Re: [RFC] network namespaces By: Daniel Lezcano on Wed, 04 October 2006 09:40
		Re: [RFC] network namespaces By: ebiederm on Sun, 10 September 2006 11:48

Previous Topic:	[PATCH 2.6.18] ext2: errors behaviour fix
Next Topic:	64bit DMA in i2o_block

Goto Forum:

-=] Back to Top [=-

[ Syndicate this forum (XML) ] [

] [

]

Current Time: Mon Sep 08 23:32:59 GMT 2025

Total time taken to generate the page: 0.09137 seconds