Linux Netfilter development
 help / color / mirror / Atom feed
From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Phil Sutter <phil@nwl.cc>, Eric Garver <eric@garver.life>,
	netfilter-devel@vger.kernel.org, Florian Westphal <fw@strlen.de>
Subject: Re: [nf-next PATCH] netfilter: nf_tables: Support updating table's owner flag
Date: Wed, 13 Dec 2023 16:54:34 +0100	[thread overview]
Message-ID: <ZXnTutEACvJPIEJx@calendula> (raw)
In-Reply-To: <ZXnS5k/iOj3g5f22@orbyte.nwl.cc>

On Wed, Dec 13, 2023 at 04:51:02PM +0100, Phil Sutter wrote:
> On Wed, Dec 13, 2023 at 04:15:50PM +0100, Pablo Neira Ayuso wrote:
[...]
> I find it sensible to protect a table only as long as the owning process
> remains alive, at least to prevent zombie tables. This raises the
> question what shall happen to orphan tables upon 'nft flush ruleset'?
> Flush them like a regular one?

I think so, otherwise such orphaned table will become an inmortal
zombie that noone can remove :)

[...]
> > I think this 'persist' flag provides semantics the described above,
> > that is:
> > 
> > - keep it in place if process goes away.
> > - allow to retake ownership.
> 
> I'll give it a try.

Thanks.

  reply	other threads:[~2023-12-13 15:54 UTC|newest]

Thread overview: 13+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-12-08 13:01 [nf-next PATCH] netfilter: nf_tables: Support updating table's owner flag Phil Sutter
2023-12-12 13:08 ` Pablo Neira Ayuso
2023-12-12 16:23   ` Phil Sutter
2023-12-12 22:47     ` Eric Garver
2023-12-13 12:13       ` Phil Sutter
2023-12-13 14:08         ` Eric Garver
2023-12-13 15:29           ` Florian Westphal
2023-12-13 15:15         ` Pablo Neira Ayuso
2023-12-13 15:51           ` Phil Sutter
2023-12-13 15:54             ` Pablo Neira Ayuso [this message]
2023-12-13 16:32           ` Thomas Haller
2023-12-13 16:45             ` Florian Westphal
2023-12-13 17:04               ` Thomas Haller

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=ZXnTutEACvJPIEJx@calendula \
    --to=pablo@netfilter.org \
    --cc=eric@garver.life \
    --cc=fw@strlen.de \
    --cc=netfilter-devel@vger.kernel.org \
    --cc=phil@nwl.cc \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox