* Secondary process access control mechanism
@ 2025-07-09 18:02 Morten Brørup
2025-07-09 21:20 ` Stephen Hemminger
0 siblings, 1 reply; 2+ messages in thread
From: Morten Brørup @ 2025-07-09 18:02 UTC (permalink / raw)
To: Anatoly Burakov; +Cc: dev
Are there any access control mechanisms to govern what a secondary process can do to a primary process?
Let's say I'm running a primary process, and want to allow only authorized secondary processes to attach to it. No unauthorized secondary processes should be able to attach to it.
I assume there is no fine grained control over which features various secondary processes can access.
Med venlig hilsen / Kind regards,
-Morten Brørup
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: Secondary process access control mechanism
2025-07-09 18:02 Secondary process access control mechanism Morten Brørup
@ 2025-07-09 21:20 ` Stephen Hemminger
0 siblings, 0 replies; 2+ messages in thread
From: Stephen Hemminger @ 2025-07-09 21:20 UTC (permalink / raw)
To: Morten Brørup; +Cc: Anatoly Burakov, dev
On Wed, 9 Jul 2025 20:02:30 +0200
Morten Brørup <mb@smartsharesystems.com> wrote:
> Are there any access control mechanisms to govern what a secondary process can do to a primary process?
>
> Let's say I'm running a primary process, and want to allow only authorized secondary processes to attach to it. No unauthorized secondary processes should be able to attach to it.
>
> I assume there is no fine grained control over which features various secondary processes can access.
>
>
> Med venlig hilsen / Kind regards,
> -Morten Brørup
>
No DPDK does not have any access control mechanism itself. But it the wrong place to do it.
What you want to protect is access to hugepages and device memory as well as the unix domain
socket channel to the primary process. For the typical case where both run as root, there really
isn't anything that can be done. But if you want security, the DPDK primary process should
be running in a container with only certain privledges granted. And the container isolation
would protect it.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2025-07-09 21:20 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2025-07-09 18:02 Secondary process access control mechanism Morten Brørup
2025-07-09 21:20 ` Stephen Hemminger
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).