Subject: Re: [PATCH] netfilter: Record uid and gid in xt_AUDIT

From: Florian Westphal <[email-masked]>
Date: Fri, 11 Oct 2024 03:27:13 +0200

Richard Weinberger <[email-masked]> wrote:
> Maybe I have wrong expectations.
> e.g. I expected that sock_net_uid() will return 1000 when
> uid 1000 does something like: unshare -Umr followed by a veth connection
> to the host (initial user/net namespace).
> Shouldn't on the host side a forwarded skb have a ->dev that belongs uid
> 1000's net namespace?

You mean skb->sk?  dev doesn't make much sense in this context to me.
Else, please clarify.

ip stack orphans incoming skbs, i.e. skb->sk is gone, see skb_orphan()
call in ip_rcv_core().  So when packet enters init_net prerouting hook,
association with originating netns or sk is not present anymore.