On Wed, 2019-02-20 at 12:49 -0700, Jason Gunthorpe wrote:
> On Wed, Feb 20, 2019 at 02:37:21PM -0500, Doug Ledford wrote:
> > >
> > gap. I say this because I don't know of any real world use involving
> > RDMA, containers, non-init_net namespaces, and RDMA access. Do you?
>
> Yes, sites are mixing RDMA and net namespace'd containers. They need
> things to not change while they review their orchestration/etc.
Ok, if the sites exist, then we need to accommodate them.
> This is the whole philosophy for Linux, don't break the
> userspace. Parav's solution is really ugly, but does get the job done.
Ok, then back to the question of the netlink control. I say we drop it
entirely and only support the kernel module. That is no more work for
the admin than running a new iproute2 command to change the mode, so
there's no argument for "but we can't require them to make any changes",
they would have to make a change either way, and then we don't have to
worry about leakage on change.
> This is doubly true when we expect to have entire classes of HW that
> can't support a 'child' ib_device. Those would be permanently broken
> with net namespaces if we don't have a compat.
In the future, if running a ns capable and a ns incapable device is ever
done in the same system, then we can bring the netlink option back and
make it one way only (can only go from ns enforced to ns unenforced) and
on a parent adapter basis, not system wide. That way it comes up
secure, and the command is added to lower the security on the device
that can't support namespaces.
--
Doug Ledford <dledford@xxxxxxxxxx>
GPG KeyID: B826A3330E572FDD
Key fingerprint = AE6B 1BDA 122B 23B4 265B 1274 B826 A333 0E57 2FDD
Attachment:
signature.asc
Description: This is a digitally signed message part
