On Mon, 2016-09-26 at 02:29 +0930, Ron wrote: [...] > I would have thought that waiting by default would probably be the > more 'backward compatible' option - though that said, if I'm correct > about the problem I saw in the script above, then defaulting to > waiting could potentially deadlock (empirically it hasn't so far with > -w added manually, but if both -L and -F take the same lock, then that > loop actually needs to be rewritten to be properly safe now ...) > > > So maybe the current behaviour _is_ the 'safest' change, and really > the only way to fix this is to audit everything calling iptables now :/ > Either option seems to have its own flavour of eww ...
It seems like the waiting behaviour could be improved by: 1. Not locking for read-only commands like 'iptables -L' (reading a table is already atomic so it shouldn't be needed). 2. Adding a timeout to break deadlocks. Ben. -- Ben Hutchings No political challenge can be met by shopping. - George Monbiot
signature.asc
Description: This is a digitally signed message part
