From: Lennart Poettering <lennart@poettering.net>
To: Jan Engelhardt <jengelh@inai.de>
Cc: Pablo Neira Ayuso <pablo@netfilter.org>,
Patrick McHardy <kaber@trash.net>,
netfilter-devel@vger.kernel.org, kernel@linuxace.com
Subject: Re: [PATCH iptables] iptables: use IPC semaphore instead of abstract unix sockets
Date: Fri, 23 Jan 2015 04:04:45 +0100 [thread overview]
Message-ID: <20150123030445.GA2931@gardel-login> (raw)
In-Reply-To: <alpine.LSU.2.11.1501191652050.28001@nerf60.vanv.qr>
On Mon, 19.01.15 16:54, Jan Engelhardt (jengelh@inai.de) wrote:
>
> On Monday 2015-01-19 14:06, Pablo Neira Ayuso wrote:
> >
> >I think the best solution is to use to flock() as others do but then
> >we need a writable filesystem() which is what Phil was trying to skip.
>
> If semaphores are no longer on the table, using shm_open for an
> flockable fd seems like an option.
> The /dev/shm directory implicitly used for that should be there in
> a normal system, so as to support POSIX shm/sem in the first place.
/dev/shm is a world-writable directory. If you use that, then
unprivileged processes can play games with you again by taking the
name away from you, and the original problem is back.
This really should be a file in /run, and nothing else.
Lennart
--
Lennart Poettering, Red Hat
next prev parent reply other threads:[~2015-01-23 3:04 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-01-18 21:13 [PATCH iptables] iptables: use IPC semaphore instead of abstract unix sockets Pablo Neira Ayuso
2015-01-18 21:28 ` Jan Engelhardt
2015-01-19 12:24 ` Pablo Neira Ayuso
2015-01-19 12:51 ` Patrick McHardy
2015-01-19 13:00 ` Pablo Neira Ayuso
2015-01-19 12:59 ` Patrick McHardy
2015-01-19 13:06 ` Pablo Neira Ayuso
2015-01-19 13:08 ` Patrick McHardy
2015-01-19 13:21 ` Pablo Neira Ayuso
2015-01-19 13:19 ` Patrick Schaaf
2015-01-19 13:34 ` Patrick Schaaf
2015-01-19 15:54 ` Jan Engelhardt
2015-01-23 3:04 ` Lennart Poettering [this message]
2015-01-19 14:21 ` Lennart Poettering
2015-01-19 14:17 ` Lennart Poettering
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20150123030445.GA2931@gardel-login \
--to=lennart@poettering.net \
--cc=jengelh@inai.de \
--cc=kaber@trash.net \
--cc=kernel@linuxace.com \
--cc=netfilter-devel@vger.kernel.org \
--cc=pablo@netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).