From: Arkadiusz Miskiewicz <a.miskiewicz@gmail.com>
To: David Miller <davem@davemloft.net>
Cc: brian.haley@hp.com, netdev@vger.kernel.org
Subject: Re: disabling ipv6 (when ipv6 module is already loaded or built in)
Date: Sun, 27 Mar 2011 23:19:15 +0200 [thread overview]
Message-ID: <201103272319.16022.a.miskiewicz@gmail.com> (raw)
In-Reply-To: <20110325.155657.193733904.davem@davemloft.net>
On Friday 25 of March 2011, David Miller wrote:
> From: Arkadiusz Miskiewicz <a.miskiewicz@gmail.com>
> Date: Fri, 25 Mar 2011 23:53:06 +0100
>
> > The whole problem is that socket(AF_INET6,...) is allowed. If setting
> > net.ipv6.conf.all.disable_ipv6=1 would also prevent such socket() from
> > succeeding then everything would be fine.
>
> You have to make this setting before the module loads, once we register
> the protocol handlers (which is what allows socket() to succeed) the
> cat is out of the bag.
>
> If even just one socket exists, we can't perform the steps necessary
> to block new ones.
>
> That's why you have to use the module option, and it is the only way
> to block this class of operations.
Hm, maybe then it could be done in a way where ipv6 is initially built in but
disabled and could be permanently enabled via sysfs/proc/something based on a
userspace (or user/admin) decision runtime? That would be analogous to
"modprobe ipv6" in kernel with modular ipv6.
--
Arkadiusz Miśkiewicz PLD/Linux Team
arekm / maven.pl http://ftp.pld-linux.org/
next prev parent reply other threads:[~2011-03-27 21:19 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-03-25 17:17 disabling ipv6 (when ipv6 module is already loaded or built in) Arkadiusz Miskiewicz
2011-03-25 20:22 ` Brian Haley
2011-03-25 22:53 ` Arkadiusz Miskiewicz
2011-03-25 22:56 ` David Miller
2011-03-27 21:19 ` Arkadiusz Miskiewicz [this message]
2011-03-27 21:24 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=201103272319.16022.a.miskiewicz@gmail.com \
--to=a.miskiewicz@gmail.com \
--cc=brian.haley@hp.com \
--cc=davem@davemloft.net \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.