From mboxrd@z Thu Jan 1 00:00:00 1970 From: Stephen Hemminger Subject: Re: [PATCH net-next] tcp: Namespace-ify sysctl_tcp_default_congestion_control Date: Mon, 13 Nov 2017 07:37:38 -0800 Message-ID: <20171113073738.6b405d77@xeon-e3> References: <20171110012637.2454-1-sthemmin@microsoft.com> <20171113.102700.2072956247690538502.davem@davemloft.net> Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Cc: edumazet@google.com, netdev@vger.kernel.org, sthemmin@microsoft.com To: David Miller Return-path: Received: from mail-pf0-f178.google.com ([209.85.192.178]:56506 "EHLO mail-pf0-f178.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753143AbdKMPhm (ORCPT ); Mon, 13 Nov 2017 10:37:42 -0500 Received: by mail-pf0-f178.google.com with SMTP id q4so3932641pfg.13 for ; Mon, 13 Nov 2017 07:37:42 -0800 (PST) In-Reply-To: <20171113.102700.2072956247690538502.davem@davemloft.net> Sender: netdev-owner@vger.kernel.org List-ID: On Mon, 13 Nov 2017 10:27:00 +0900 (KST) David Miller wrote: > From: Stephen Hemminger > Date: Fri, 10 Nov 2017 10:26:37 +0900 > > > Make default TCP default congestion control to a per namespace > > value. The congestion control setting of new namespaces is inherited > > from the root namespace. Modules are only autoloaded in the root namespace. > > > > Signed-off-by: Stephen Hemminger > > I have to think some more about this and the semantics you've choosen. > > Is it really buying us anything to restrict the module load to the > initial namespace? Unless it's really required this makes things like > running tests in sub-namespaces unnecessarily cumbersome. The motivation for this came from Eric Dumazet who has tests that run in namespaces, and doing a per-namespace setup is good way to control the default congestion control. The restriction came from earlier discussion with Kees and Eric. The security folks are paranoid about containers allowing loading of modules. Probably CAP_SYS_MODULE is enough to control this already.