#ifndef DIE_H #define DIE_H #include #include #include #include #include #include #include #include #include "built_in.h" static inline void panic(const char *format, ...) __check_format_printf(1, 2); static inline void syslog_panic(const char *format, ...) __check_format_printf(1, 2); static inline void syslog_maybe(bool cond, int priority, const char *format, ...) __check_format_printf(3, 4); static inline void __noreturn __die_hard(void) { exit(EXIT_FAILURE); } static inline void __noreturn __die_harder(void) { _exit(EXIT_FAILURE); } static inline void __noreturn die(void) { __die_hard(); } static inline void __noreturn _die(void) { __die_harder(); } static inline void __noreturn panic(const char *format, ...) { va_list vl; va_start(vl, format); vfprintf(stderr, format, vl); va_end(vl); die(); } static inline void __noreturn syslog_panic(const char *format, ...) { va_list vl; va_start(vl, format); vsyslog(LOG_ERR, format, vl); va_end(vl); die(); } static inline void syslog_maybe(bool cond, int priority, const char *format, ...) { if (cond) { va_list vl; va_start(vl, format); vsyslog(priority, format, vl); va_end(vl); } } #endif /* DIE_H */ ption> net-next plumbingsTobias Klauser
summaryrefslogtreecommitdiff
path: root/net/ipv4
diff options
context:
space:
mode:
authorMichal Kubeček <mkubecek@suse.cz>2017-01-31 10:30:06 +0100
committerPablo Neira Ayuso <pablo@netfilter.org>2017-02-02 14:31:58 +0100
commit2851940ffee313e0ff12540a8e11a8c54dea9c65 (patch)
tree0fe2bf02a3125fc7a13800ded0d34812fda92e60 /net/ipv4
parent90c1aff702d449a1a248c4829d51c0bc677f968e (diff)
netfilter: allow logging from non-init namespaces
Commit 69b34fb996b2 ("netfilter: xt_LOG: add net namespace support for xt_LOG") disabled logging packets using the LOG target from non-init namespaces. The motivation was to prevent containers from flooding kernel log of the host. The plan was to keep it that way until syslog namespace implementation allows containers to log in a safe way. However, the work on syslog namespace seems to have hit a dead end somewhere in 2013 and there are users who want to use xt_LOG in all network namespaces. This patch allows to do so by setting /proc/sys/net/netfilter/nf_log_all_netns to a nonzero value. This sysctl is only accessible from init_net so that one cannot switch the behaviour from inside a container. Signed-off-by: Michal Kubecek <mkubecek@suse.cz> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/ipv4')
-rw-r--r--net/ipv4/netfilter/nf_log_arp.c2
-rw-r--r--net/ipv4/netfilter/nf_log_ipv4.c2
2 files changed, 2 insertions, 2 deletions
diff --git a/net/ipv4/netfilter/nf_log_arp.c b/net/ipv4/netfilter/nf_log_arp.c