mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: Gao feng <gaofeng@cn.fujitsu.com>
To: containers@lists.linux-foundation.org, linux-audit@redhat.com,
	linux-kernel@vger.kernel.org
Cc: eparis@redhat.com, serge.hallyn@ubuntu.com,
	ebiederm@xmission.com, sgrubb@redhat.com, aris@redhat.com,
	matthltc@linux.vnet.ibm.com, Gao feng <gaofeng@cn.fujitsu.com>
Subject: [PATCH 15/22] Audit: only allow init user namespace to change backlog_limit
Date: Wed, 19 Jun 2013 09:53:47 +0800	[thread overview]
Message-ID: <1371606834-5802-16-git-send-email-gaofeng@cn.fujitsu.com> (raw)
In-Reply-To: <1371606834-5802-1-git-send-email-gaofeng@cn.fujitsu.com>

Prevent un-init user namespace from generating lots of skb.

Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
---
 kernel/audit.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/kernel/audit.c b/kernel/audit.c
index 79a8b8e..297ac6e 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -303,6 +303,9 @@ static int audit_set_rate_limit(int limit)
 
 static int audit_set_backlog_limit(int limit)
 {
+	if (current_user_ns() != &init_user_ns)
+		return -EPERM;
+
 	return audit_do_config_change("audit_backlog_limit", &audit_backlog_limit, limit);
 }
 
-- 
1.8.1.4


  parent reply	other threads:[~2013-06-19  1:53 UTC|newest]

Thread overview: 39+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2013-06-19  1:53 [Part1 PATCH 00/22] Add namespace support for audit Gao feng
2013-06-19  1:53 ` [PATCH 01/22] Audit: change type of audit_ever_enabled to bool Gao feng
2013-06-19  1:53 ` [PATCH 02/22] Audit: remove duplicate comments Gao feng
2013-06-19  1:53 ` [PATCH 03/22] Audit: make audit kernel side netlink sock per userns Gao feng
2013-06-19  1:53 ` [PATCH 04/22] netlink: Add compare function for netlink_table Gao feng
2013-06-19  1:53 ` [PATCH 05/22] Audit: implement audit self-defined compare function Gao feng
2013-06-19  1:53 ` [PATCH 06/22] Audit: make audit_skb_queue per user namespace Gao feng
2013-06-19  1:53 ` [PATCH 07/22] Audit: make audit_skb_hold_queue " Gao feng
2013-06-19  1:53 ` [PATCH 08/22] Audit: make kauditd_task " Gao feng
2013-06-19  1:53 ` [PATCH 09/22] Audit: make audit_nlk_portid per user namesapce Gao feng
2013-06-19  1:53 ` [PATCH 10/22] Audit: make audit_enabled per user namespace Gao feng
2013-06-19  1:53 ` [PATCH 11/22] Audit: make audit_ever_enabled " Gao feng
2013-06-19  1:53 ` [PATCH 12/22] Audit: make audit_initialized " Gao feng
2013-06-19  1:53 ` [PATCH 13/22] Audit: only allow init user namespace to change rate limit Gao feng
2013-06-19  1:53 ` [PATCH 14/22] Audit: only allow init user namespace to change audit_failure Gao feng
2013-06-19  1:53 ` Gao feng [this message]
2013-06-19  1:53 ` [PATCH 16/22] Audit: make kauditd_wait per user namespace Gao feng
2013-06-19  1:53 ` [PATCH 17/22] Audit: make audit_backlog_wait " Gao feng
2013-06-19  1:53 ` [PATCH 18/22] Audit: introduce new audit logging interface for " Gao feng
2013-06-19  1:53 ` [PATCH 19/22] Audit: pass proper user namespace to audit_log_common_recv_msg Gao feng
2013-06-19  1:53 ` [PATCH 20/22] Audit: Log audit config change in uninit user namespace Gao feng
2013-06-19  1:53 ` [PATCH 21/22] Audit: send reply message to the auditd in proper " Gao feng
2013-06-19  1:53 ` [PATCH 22/22] Audit: Allow GET,SET,USER MSG operations in uninit " Gao feng
2013-06-19 20:49 ` [Part1 PATCH 00/22] Add namespace support for audit Aristeu Rozanski
2013-06-19 20:51   ` Eric Paris
2013-06-19 21:03     ` Eric W. Biederman
2013-06-20  5:21       ` Gao feng
2013-06-20  3:02     ` Gao feng
2013-06-20  3:09       ` Gao feng
2013-06-20 22:01         ` Eric W. Biederman
2013-06-21  5:15           ` Gao feng
2013-06-24 15:02           ` Aristeu Rozanski
2013-06-24 19:03             ` Eric W. Biederman
2013-06-20 13:02       ` Eric Paris
2013-06-20 20:45         ` Serge E. Hallyn
2013-06-21  3:48         ` Gao feng
2013-06-21  9:51           ` Daniel J Walsh
2013-06-21 10:49             ` Eric W. Biederman
2013-07-04  3:30           ` Gao feng

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1371606834-5802-16-git-send-email-gaofeng@cn.fujitsu.com \
    --to=gaofeng@cn.fujitsu.com \
    --cc=aris@redhat.com \
    --cc=containers@lists.linux-foundation.org \
    --cc=ebiederm@xmission.com \
    --cc=eparis@redhat.com \
    --cc=linux-audit@redhat.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=matthltc@linux.vnet.ibm.com \
    --cc=serge.hallyn@ubuntu.com \
    --cc=sgrubb@redhat.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®