On Mon, Jan 19, 2015 at 07:09:17PM +0100, Pablo Neira Ayuso wrote:
> Abstract unix sockets cannot be used to synchronize several concurrent
> instances of iptables since an unpriviledged process can create them and
> prevent the legitimate iptables instance from running.
>
> Use flock() and /run instead as suggested by Lennart Poettering.
>
> Fixes: 93587a0 ("ip[6]tables: Add locking to prevent concurrent instances")
> Reported-by: Lennart Poettering <lennart@xxxxxxxxxxxxxx>
Looks good Pablo. Thanks for finding this Lennart.
Phil
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
