Re: [PATCH net-next v4 0/7] vsock: assign the guest vsock device to a network namespace

[Stefano Garzarella]

On Tue, Oct 20, 2026 at 06:15:03PM -0700, Bobby Eshleman wrote:
> vsock network namespaces let a host put each VM in a namespace of its
> own. A guest has no equivalent yet. It has a single G2H device that
> cannot be assigned to a network namespace.
>
> This series lets a guest move that device into a network namespace. A
> new generic netlink family, "vsock", supports the command
> VSOCK_CMD_DEV_NETNS_SET which assigns the device to the namespace the
> request was sent from. The namespace's existing ns_mode then decides who
> may use it: a "global" namespace shares the device with every other
> global namespace, and a "local" namespace keeps the host connection to
> itself. The device starts out in the initial namespace, so until the
> command is issued nothing has moved and no mode has changed. There is no
> explicit unassign as assigning the device back to the initial namespace
> is equivalent.
>
> The command requires CAP_NET_ADMIN in the initial user namespace, so
> that an unprivileged user namespace cannot claim the device.
>
> Connections that can no longer reach the device after a move are reset,
> so that a namespace which has lost access cannot keep using a socket it
> opened while it still had access. The assignment holds a reference on
> the namespace, so deleting that namespace does not move the device; only
> another assignment does.
>
> Transports opt in through a new netns_assign_allow flag. Only
> virtio-vsock sets it here, because it is the only guest transport
> that I am able to test against.
>
> Based off of Stefano's original series:
> https://lore.kernel.org/all/20200116172428.311437-1-sgarzare@xxxxxxxxxx/
>
> Suggested-by: Stefano Garzarella <sgarzare@xxxxxxxxxx>
> Link: https://lore.kernel.org/all/20200427142518.uwssa6dtasrp3bfc@steredhat/
> Signed-off-by: Bobby Eshleman <bobbyeshleman@xxxxxxxx>
> ---
> Changes in v4:
> - All Sashiko fixes (see individual patch change lists)
> - Link to v3: https://lore.kernel.org/r/20261012-vsock-guest-ns-v3-0-b32447c66b23@xxxxxxxx

Sorry, yesterday I started to review v3, but didn't post comments :-(
I'll send on this series.

Thanks,
Stefano