* [BUG NFQUEUE] NFQUEUE readers get -PERM from sys_sendto() if !root
@ 2013-03-21 14:36 Holger Eitzenberger
2013-03-21 15:19 ` Holger Eitzenberger
0 siblings, 1 reply; 2+ messages in thread
From: Holger Eitzenberger @ 2013-03-21 14:36 UTC (permalink / raw)
To: netfilter-devel; +Cc: netdev, Eric W. Biederman
Hi,
after updating to kernel v3.8.4 I see that Netfilter NFQUEUE readers
get -EPERM from sys_sendto() at the time they try to inject the verdict
back to the kernel. This only occurs iff not running as 'root'.
The last working kernel is v3.7.7.
Skimming through the changeset since v3.7.7 the following changes
pop up:
userns: Require CAP_SYS_ADMIN for most uses of setns.
userns: Allow unprivileged use of setns.
So it could be related to my current namespace config, which is
CONFIG_NAMESPACES=y
# CONFIG_UTS_NS is not set
# CONFIG_IPC_NS is not set
# CONFIG_USER_NS is not set
# CONFIG_PID_NS is not set
# CONFIG_NET_NS is not set
I rate this a major issue, as quite some of those programs
drop privileges for various reasons.
Is this a known issue? Well, I skimmed through the list, but didn't
find anything.
/Holger
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [BUG NFQUEUE] NFQUEUE readers get -PERM from sys_sendto() if !root
2013-03-21 14:36 [BUG NFQUEUE] NFQUEUE readers get -PERM from sys_sendto() if !root Holger Eitzenberger
@ 2013-03-21 15:19 ` Holger Eitzenberger
0 siblings, 0 replies; 2+ messages in thread
From: Holger Eitzenberger @ 2013-03-21 15:19 UTC (permalink / raw)
To: netfilter-devel, netdev, Eric W. Biederman
Turns out that this is some broken interaction with some
internal patches. Sorry for the noise.
/Holger
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2013-03-21 15:20 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-03-21 14:36 [BUG NFQUEUE] NFQUEUE readers get -PERM from sys_sendto() if !root Holger Eitzenberger
2013-03-21 15:19 ` Holger Eitzenberger
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).