mirror of https://github.com/torvalds/linux.git
102eab95f0
Two administrator processes may race when setting child_ns_mode as one
process sets child_ns_mode to "local" and then creates a namespace, but
another process changes child_ns_mode to "global" between the write and
the namespace creation. The first process ends up with a namespace in
"global" mode instead of "local". While this can be detected after the
fact by reading ns_mode and retrying, it is fragile and error-prone.
Make child_ns_mode write-once so that a namespace manager can set it
once and be sure it won't change. Writing a different value after the
first write returns -EBUSY. This applies to all namespaces, including
init_net, where an init process can write "local" to lock all future
namespaces into local mode.
Fixes:
|
||
|---|---|---|
| .. | ||
| bpf.h | ||
| can.h | ||
| conntrack.h | ||
| core.h | ||
| flow_table.h | ||
| generic.h | ||
| hash.h | ||
| ieee802154_6lowpan.h | ||
| ipv4.h | ||
| ipv6.h | ||
| mctp.h | ||
| mib.h | ||
| mpls.h | ||
| netfilter.h | ||
| nexthop.h | ||
| nftables.h | ||
| packet.h | ||
| sctp.h | ||
| smc.h | ||
| unix.h | ||
| vsock.h | ||
| xdp.h | ||
| xfrm.h | ||