From mboxrd@z Thu Jan 1 00:00:00 1970 From: Pablo Neira Ayuso Subject: Re: [PATCH net] netfilter: nftables: Do not run chains in the wrong network namespace Date: Fri, 19 Jun 2015 19:21:28 +0200 Message-ID: <20150619172128.GA4607@salvia> References: <87oakbg0ym.fsf@x220.int.ebiederm.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: David Miller , netdev@vger.kernel.org, netfilter-devel@vger.kernel.org, Patrick McHardy To: "Eric W. Biederman" Return-path: Content-Disposition: inline In-Reply-To: <87oakbg0ym.fsf@x220.int.ebiederm.org> Sender: netfilter-devel-owner@vger.kernel.org List-Id: netdev.vger.kernel.org On Fri, Jun 19, 2015 at 10:41:21AM -0500, Eric W. Biederman wrote: > > Currenlty nf_tables chains added in one network namespace are being > run in all network namespace. The issues are myriad with the simplest > being an unprivileged user can cause any network packets to be dropped. > > Address this by simply not running nf_tables chains in the wrong > network namespace. > > Cc: stable@vger.kernel.org > Signed-off-by: "Eric W. Biederman" Acked-by: Pablo Neira Ayuso @David: Patrick sent a similar patch to address this, if you can get this into the net tree, I'll make sure this propagates to -stable. Thanks. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in