25bc2d5c1d
systemd creates a new network namespace for services which are using PrivateNetwork=yes. In the implementation, systemd uses a socketpair as a storage buffer for the namespace reference file descriptor (c.f. https://github.com/systemd/systemd/blob/v228/src/core/namespace.c#L660). One end of this socketpair is locked (hence the need of "lock" access to self:unix_dgram_socket for init_t) while systemd opens /proc/self/ns/net, which lives in nsfs. While at it, add filesystem_type attribute to nsfs_t. |
||
|---|---|---|
| .. | ||
| admin | ||
| apps | ||
| contrib@35cd3decfd | ||
| kernel | ||
| roles | ||
| services | ||
| system | ||