From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Serge E. Hallyn" Subject: [PATCH RFC] refuse c/r with nested network namespaces Date: Tue, 15 Dec 2009 15:58:54 -0600 Message-ID: <20091215215854.GA26783@us.ibm.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org Errors-To: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org To: Oren Laadan Cc: Linux Containers List-Id: containers.vger.kernel.org ...because we can't restore network devices in private namespaces anyway. This leaves userspace to set up network devices however it wants at restart, and leaves it free to restart the application either in the global or a private (configured) network namespace. Signed-off-by: Serge E. Hallyn --- kernel/nsproxy.c | 7 +++++++ 1 files changed, 7 insertions(+), 0 deletions(-) diff --git a/kernel/nsproxy.c b/kernel/nsproxy.c index c91b725..851777a 100644 --- a/kernel/nsproxy.c +++ b/kernel/nsproxy.c @@ -291,6 +291,13 @@ static int do_checkpoint_ns(struct ckpt_ctx *ctx, struct nsproxy *nsproxy) /* TODO: Write other namespaces here */ + /* We do not support >1 private netns */ + ret = -EINVAL; + if (nsproxy->net_ns != ctx->root_nsproxy->net_ns) { + ckpt_err(ctx, ret, "%(T)Nested net_ns unsupported\n"); + goto out; + } + ret = ckpt_write_obj(ctx, &h->h); out: ckpt_hdr_put(ctx, h); -- 1.6.1