[lxc-devel] [PATCH] netns: unix: only allow to find out unix socket in same net namespace

[Gao feng]

On 08/21/2013 06:42 PM, Eric W. Biederman wrote:
> Gao feng <gaofeng at cn.fujitsu.com> writes:
> 
>> right now I only take note of the unix socket /run/systemd/private,
>> but there may have many similar unix sockets, they can exist in any
>> path. the strange problems will still happen.
> 
> It could just as easily have been a fifo in the filesystem, and the
> result would have been the same.
> 
> The network namespace are all about communicating between network
> namespaces and that is what was allowed here.
> 
> If you don't want a socket or a fifo or any other file to be used by a
> container don't give it access to it.  It really is that simple.
> 

Hmm, I tend to think you are right...

Thanks!