Re: [PATCH net-next v3 4/7] vsock: add a netlink command to assign the g2h device to a netns

[sashiko-bot@kernel.org]

> Namespaces let a host isolate a VM's vsock traffic to a specific
> namespace, but in a guest vsock traffic cannot be isolated to a
> namespace. The vsock device is hardcoded to global mode and can't be
> moved into a local-mode namespace.
> 
> Introduce a vsock generic netlink family with VSOCK_CMD_DEV_NETNS_SET,
> which moves the device to the namespace the request was sent from.
> 
> VSOCK_CMD_DEV_NETNS_GET reads the assignment back, reporting the
> namespace as an nsid relative to the caller. VSOCK_CMD_DEV_NETNS_SET
> replies with the same message.
> 
> The command requires CAP_NET_ADMIN in the initial user namespace. A
> privileged user wishing to "unassign" the device can move it to the
> init_net, which is hardcoded to global mode (so no unassign call is
> [ ... ]
> user namespace is required for the assignment.
> 
> Suggested-by: Stefano Garzarella <sgarzare@redhat.com>
> Link: https://lore.kernel.org/all/20200427142518.uwssa6dtasrp3bfc@steredhat/
> Signed-off-by: Bobby Eshleman <bobbyeshleman@meta.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261012-vsock-guest-ns-v3-0-b32447c66b23@meta.com?part=4