]> git.ipfire.org Git - thirdparty/systemd.git/commit
nsresourced,vmspawn: allow unpriv "tap" based networking in vmspawn (#36688)
authorYu Watanabe <watanabe.yu+github@gmail.com>
Mon, 17 Mar 2025 22:34:03 +0000 (07:34 +0900)
committerGitHub <noreply@github.com>
Mon, 17 Mar 2025 22:34:03 +0000 (07:34 +0900)
commit8e29a5b9b3ef8f36b6de1194bd02761ff8ca142f
tree2143b73aa63546153437876f0b40ab00560e441d
parent0201114bb7f347015ed4d85256637921dc304fe0
parent2f3314bce683058548b422d43ef09b9b1bbba8a2
nsresourced,vmspawn: allow unpriv "tap" based networking in vmspawn (#36688)

This extends nsresourced to also allow delegation of a network tap
device (in addition to veth) to unpriv clients, with a strictly enforced
naming scheme.

also tightens security on a couple of things:

* enforces polkit on all nsresourced ops too (though by default still
everything is allowed)
* put a limit on delegated network devices
* forcibly clean up delegated network devices when the userns goes away