Hannes Frederic Sowa <han...@stressinduktion.org> writes: > On 18.05.2016 22:43, Daniel Borkmann wrote: >> Eric, please send the patch officially and feel free to add my Ack.
Done. >> Given >> the circumstances, moving to mount_nodev() seems the best way forward. To >> also address above mentioned concern from Hannes, we need to remove the >> FS_USERNS_MOUNT flag along with the change. It looks like the fix is best >> addressed in a single patch if you want to include it. If not, we can >> otherwise send it separately as well, I don't mind. > > I agree. Would make most sense to make the change in one patch. Later on > we can reason about if it makes sense to use the net namespace to split > bpf maps and programs or maybe even introduce a new primitive for that. I will let you two take care of the FS_USERNS_MOUNT flag. Removal of the FS_USERNS_MOUNT flag because it was added prematurely is a completely different analysis of consequences and possible regressions in userspace. The two changes should be kept separate to make it easy to handle the unlikely case that either of them cause a regression. But I have not objections to removing the FS_USERNS_MOUNT flag from the bpf filesystem. Eric
