Hi Szymon,Hi, Marcel
from how I read the change, then yes, the container could start another bluetoothd or btmon. As long as you use an user namespace and gain CAP_NET_ADMIN and CAP_NET_RAW privileges.Does this mean one could sniff BT traffic from container? Or controlHiï MarcelBy now kernel only supported creating bluetooth socket in init_netbefore I apply such a patch, what is the actual change here. What impact
net namespace, which made bluetooth device cannot be accessed in
containers, this patch made bluetooth socket can be created in
net namespaces to fix this issue.
Signed-off-by: Fupan Li <fupan.li@xxxxxxxxxxxxx>
---
net/bluetooth/af_bluetooth.c | 2 +-
net/bluetooth/bnep/sock.c | 4 ++--
net/bluetooth/cmtp/sock.c | 4 ++--
net/bluetooth/hci_sock.c | 4 ++--
net/bluetooth/hidp/sock.c | 4 ++--
net/bluetooth/l2cap_sock.c | 4 ++--
net/bluetooth/rfcomm/core.c | 2 +-
net/bluetooth/rfcomm/sock.c | 4 ++--
net/bluetooth/sco.c | 4 ++--
9 files changed, 16 insertions(+), 16 deletions(-)
diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index 91e3ba280706..eec5ac17faee 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -113,7 +113,7 @@ static int bt_sock_create(struct net *net, struct
socket *sock, int proto,
{
int err;
- if (net != &init_net)
+ if (!net_eq(net, current->nsproxy->net_ns))
return -EAFNOSUPPORT;
does this have? Are things like Bluetooth mgmt sockets still operating
correctly after this? We have no support for move a Bluetooth controller
into a container. The Bluetooth hardware is global.
This patch hasn't nothing to do with the Bluetooth hardware, the hardware is
still global.
But before you apply this patch, you cannot access the bluetooth hardware in
a container,
since you cannot create a bluetooth socket if you are not in the init_net
namespace.
After applying this patch, you can access the bluetooth hardware both in the
init_net namespace
and containers.
BT hw from multiple containers?
I am actually not convinced we really want this. More useful seems the fact to create a virtual child hciX controller that then can be moved into container. It would use the parent hciX controller as real hardware. However this most likely only works for BLE since with BR/EDR this is rather complicated and there are actual role limits.
Regards
Marcel