From mboxrd@z Thu Jan 1 00:00:00 1970 From: ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org (Eric W. Biederman) Subject: Re: [PATCH 17/16] net: Disable netfilter sockopts when not in the initial network namespace Date: Mon, 10 Sep 2007 09:27:54 -0600 Message-ID: References: <46E54B96.8060105@openvz.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: In-Reply-To: <46E54B96.8060105-GEFAQzZX7r8dnm+yROfE0A@public.gmane.org> (Pavel Emelyanov's message of "Mon, 10 Sep 2007 17:50:14 +0400") List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org Errors-To: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org To: Pavel Emelyanov Cc: Linux Containers , netdev-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, David Miller List-Id: containers.vger.kernel.org Pavel Emelyanov writes: > Eric W. Biederman wrote: >> Until we support multiple network namespaces with netfilter only allow >> netfilter configuration in the initial network namespace. > > PATCH 17/16? :) Exactly! If my target was the core of the networking stack I figured I better include the change that keeps netfilter commands isolated to the initial network namespace, and in my review of completeness I had missed that in my first pass through my patches. Eric