> Namespaces let a host isolate a VM's vsock traffic to a specific > namespace, but in a guest vsock traffic cannot be isolated to a > namespace. The vsock device is hardcoded to global mode and can't be > moved into a local-mode namespace. > > Introduce a vsock generic netlink family with VSOCK_CMD_DEV_NETNS_SET, > which moves the device to the namespace the request was sent from. > > VSOCK_CMD_DEV_NETNS_GET reads the assignment back, reporting the > namespace as an nsid relative to the caller. VSOCK_CMD_DEV_NETNS_SET > replies with the same message. > > The command requires CAP_NET_ADMIN in the initial user namespace. A > privileged user wishing to "unassign" the device can move it to the > init_net, which is hardcoded to global mode (so no unassign call is > [ ... ] > user namespace is required for the assignment. > > Suggested-by: Stefano Garzarella <[email protected]> > Link: https://lore.kernel.org/all/20200427142518.uwssa6dtasrp3bfc@steredhat/ > Signed-off-by: Bobby Eshleman <[email protected]>
Sashiko has reviewed this patch and found no issues. It looks great! -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=4
