Re: [PATCH iptables] iptables: use IPC semaphore instead of abstract unix sockets

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Sun, Jan 18, 2015 at 10:28:32PM +0100, Jan Engelhardt wrote:
> On Sunday 2015-01-18 22:13, Pablo Neira Ayuso wrote:
> 
> >This patch introduces a semaphore
> >index b18022e..80eed2c 100644
> >--- a/iptables/xshared.c
> >+++ b/iptables/xshared.c
> >+static int xtables_check_owner(int semid)
> >+{
> >+	int ret;
> >+	struct semid_ds ds;
> >+
> >+	ret = semctl(semid, 0, IPC_STAT, &ds);
> 
> Is there a particular reason you are not using the POSIX semaphores?
> [sem_open/shm_open as per sem_overview(7)].

Please, read the patch description:

"This patch introduces a semaphore that is identified by the path to
the iptables binary, it also relies on SEM_UNDO so the kernel performs
the up() operation at process exit to avoid races with signals. This
also avoids file locks that require a writable filesystem."