From mboxrd@z Thu Jan 1 00:00:00 1970 From: ebiederm@xmission.com (Eric W. Biederman) Subject: Re: RFC: netfilter: nf_conntrack: add support for "conntrack zones" Date: Tue, 23 Feb 2010 17:43:10 -0800 Message-ID: References: <4B4F24AC.70105@trash.net> <1263481549.23480.24.camel@bigi> <4B4F3A50.1050400@trash.net> <1263490403.23480.109.camel@bigi> <4B50403A.6010507@trash.net> <1263568754.23480.142.camel@bigi> <1266875729.3673.12.camel@bigi> <1266931623.3973.643.camel@bigi> <1266934817.3973.654.camel@bigi> <1266966581.3973.675.camel@bigi> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: Daniel Lezcano , Patrick McHardy , Linux Netdev List , containers@lists.linux-foundation.org, Netfilter Development Mailinglist , Ben Greear To: hadi@cyberus.ca Return-path: Received: from out01.mta.xmission.com ([166.70.13.231]:56983 "EHLO out01.mta.xmission.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752896Ab0BXBnU (ORCPT ); Tue, 23 Feb 2010 20:43:20 -0500 In-Reply-To: <1266966581.3973.675.camel@bigi> (jamal's message of "Tue\, 23 Feb 2010 18\:09\:41 -0500") Sender: netfilter-devel-owner@vger.kernel.org List-ID: jamal writes: > On Tue, 2010-02-23 at 12:00 -0800, Eric W. Biederman wrote: > >> That point of the mount to hold a persistent reference to the >> namespace without using a process. >> >> The point of the of the to be written set_ns call is to change >> the default network namespace of the process such that all future >> open/bind/socket calls happen in the referenced network namespace. > > Ok, i like it ;-> Patches RSN? Let me if you want someone to test.. My target will be 2.6.35. There is an old prototype implementation that hit the containers list and I think netdev a year or so ago. >> The are a few stray places like sysfs where it is the mount point >> not current->nsproxy->net_ns that will determine what we see. > > Is sysfs considered "usable enough" for namespaces? Mine is ;) I had a bad cold and didn't get through all of the patches this development cycle, just all the prereqs. I plan on getting that final conversation started for as soon as 2.6.34-rc1 hits. >> Attributes of the specific namespace? > > Well, example what is being un/shared etc. Got it. Implementation wise I'm going to stash a pointer to the namespace in a inode or super block, simple. Eric