Re: [PATCH 0/2] Security improvements for xt_SYSRQ

[John Haxby <john.haxby@oracle.com>]

On 24/06/11 14:14, John Haxby wrote:
> These two patches are something I promised a long time ago and never
> actually got around to.
> [snip]

I'd like to ask, again, if we can include these upstream.

Last time I asked, Patrick McHardy not unreasonably suggested that
rather than being part of iptables (xtables) this would be better as a
standalone module.   This seemed like a good idea: putting the sysrq
handler in an encapsulation socket gets it running in BH context so that
it even works when the machine is mostly wedged and you can still use
iptables for filtering to protect the destination address and port.

This worked beautifully until I tried to extend it to cover IPv6: IPv6
doesn't have an encapsulation socket (and probably shouldn't have).  I
really don't want to provide an IPv4-only solution: that won't even work
today in some environments and it will certainly look rather lame before
long.

So can we have xt_SYSRQ upstream please?  Pretty please? :-)

jch