search for: unproivileg

...ly read. > Another thing I noticed, which is really more to do with the generic > AF_VSOCK bits than anything to do with your patches is that there is no > limitations on which vsock ports a non-privileged user can bind to and > relatedly that there is no netns support so e.g. users in unproivileged > containers can bind to any vsock port and talk to the host, which might > be undesirable. For my use for now I just went with the big hammer > approach of denying access from anything other than init_net > namespace[1] while I consider what the right answer is. From the vhost point...

...ly read. > Another thing I noticed, which is really more to do with the generic > AF_VSOCK bits than anything to do with your patches is that there is no > limitations on which vsock ports a non-privileged user can bind to and > relatedly that there is no netns support so e.g. users in unproivileged > containers can bind to any vsock port and talk to the host, which might > be undesirable. For my use for now I just went with the big hammer > approach of denying access from anything other than init_net > namespace[1] while I consider what the right answer is. From the vhost point...

...not while processing the op? Another thing I noticed, which is really more to do with the generic AF_VSOCK bits than anything to do with your patches is that there is no limitations on which vsock ports a non-privileged user can bind to and relatedly that there is no netns support so e.g. users in unproivileged containers can bind to any vsock port and talk to the host, which might be undesirable. For my use for now I just went with the big hammer approach of denying access from anything other than init_net namespace[1] while I consider what the right answer is. Ian. [0]?http://thread.gmane.org/gmane....

...Another thing I noticed, which is really more to do with the generic > > AF_VSOCK bits than anything to do with your patches is that there is no > > limitations on which vsock ports a non-privileged user can bind to and > > relatedly that there is no netns support so e.g. users in unproivileged > > containers can bind to any vsock port and talk to the host, which might > > be undesirable. For my use for now I just went with the big hammer > > approach of denying access from anything other than init_net > > namespace[1] while I consider what the right answer is. &...

This series is based on Michael Tsirkin's vhost branch (v4.5-rc6). I'm about to process Claudio Imbrenda's locking fixes for virtio-vsock but first I want to share the latest version of the code. Several people are playing with vsock now so sharing the latest code should avoid duplicate work. v5: * Transport reset event for live migration support * Reorder virtqueues, drop unused

This series is based on Michael Tsirkin's vhost branch (v4.5-rc6). I'm about to process Claudio Imbrenda's locking fixes for virtio-vsock but first I want to share the latest version of the code. Several people are playing with vsock now so sharing the latest code should avoid duplicate work. v5: * Transport reset event for live migration support * Reorder virtqueues, drop unused