On Thu, 16 Apr 2015, Herbert Xu wrote:
> On Wed, Apr 15, 2015 at 05:41:26PM +0200, Nicolas Dichtel wrote:
> > Le 15/04/2015 15:57, Herbert Xu a écrit :
> > >On Wed, Apr 15, 2015 at 06:22:29PM +0800, Herbert Xu wrote:
> > [snip]
> > >Subject: skbuff: Do not scrub skb mark within the same name space
> > >
> > >The commit ea23192e8e577dfc51e0f4fc5ca113af334edff9 ("tunnels:
> > Maybe add a Fixes tag?
> > Fixes: ea23192e8e57 ("tunnels: harmonize cleanup done on skb on rx path")
> >
> > >harmonize cleanup done on skb on rx path") broke anyone trying to
> > >use netfilter marking across IPv4 tunnels. While most of the
> > >fields that are cleared by skb_scrub_packet don't matter, the
> > >netfilter mark must be preserved.
> > >
> > >This patch rearranges skb_scurb_packet to preserve the mark field.
> > nit: s/scurb/scrub
> >
> > Else it's fine for me.
>
> Sure.
>
> PS I used the wrong email for James the first time around. So
> let me repeat the question here. Should secmark be preserved
> or cleared across tunnels within the same name space? In fact,
> do our security models even support name spaces?
They don't support namespaces, and maintaining the label is critical for
SELinux, at least, which mediates security for the system as a whole.
--
James Morris
<jmor...@namei.org>
