[lxc-devel] [PATCH] netns: unix: only allow to find out unix socket in same net namespace

[Eric W. Biederman]

Gao feng <gaofeng at cn.fujitsu.com> writes:

> right now I only take note of the unix socket /run/systemd/private,
> but there may have many similar unix sockets, they can exist in any
> path. the strange problems will still happen.

It could just as easily have been a fifo in the filesystem, and the
result would have been the same.

The network namespace are all about communicating between network
namespaces and that is what was allowed here.

If you don't want a socket or a fifo or any other file to be used by a
container don't give it access to it.  It really is that simple.

Eric