diff options
| author | Denton Gentry <dgentry@tailscale.com> | 2021-06-29 21:13:00 -0700 |
|---|---|---|
| committer | Denton Gentry <denny@geekhold.com> | 2021-07-14 10:01:14 -0700 |
| commit | d2480fd508fb9ffb5582141a24cb14cc19388e2f (patch) | |
| tree | 26cad30e1eb42c8d21a15fba2e2cf6d19d32b3ac /control/controlknobs | |
| parent | 1896bf99d92bab4704f8078e9344d0557236d3f7 (diff) | |
| download | tailscale-d2480fd508fb9ffb5582141a24cb14cc19388e2f.tar.xz tailscale-d2480fd508fb9ffb5582141a24cb14cc19388e2f.zip | |
net/netns: support !CAP_NET_ADMIN
netns_linux checked whether "ip rule" could run to determine
whether to use SO_MARK for network namespacing. However in
Linux environments which lack CAP_NET_ADMIN, such as various
container runtimes, the "ip rule" command succeeds but SO_MARK
fails due to lack of permission. SO_BINDTODEVICE would work in
these environments, but isn't tried.
In addition to running "ip rule" check directly whether SO_MARK
works or not. Among others, this allows Microsoft Azure App
Service and AWS App Runner to work.
Signed-off-by: Denton Gentry <dgentry@tailscale.com>
Diffstat (limited to 'control/controlknobs')
0 files changed, 0 insertions, 0 deletions