| Message ID | 20211012145437.754391-1-atenart@kernel.org |
|---|---|
| State | Accepted |
| Delegated to: | Pablo Neira |
| Headers | show |
| Series | [net] netfilter: ipvs: make global sysctl readonly in non-init netns | expand |
Hello, On Tue, 12 Oct 2021, Antoine Tenart wrote: > Because the data pointer of net/ipv4/vs/debug_level is not updated per > netns, it must be marked as read-only in non-init netns. > > Fixes: c6d2d445d8de ("IPVS: netns, final patch enabling network name space.") > Signed-off-by: Antoine Tenart <atenart@kernel.org> Looks good to me, thanks! Acked-by: Julian Anastasov <ja@ssi.bg> > --- > net/netfilter/ipvs/ip_vs_ctl.c | 5 +++++ > 1 file changed, 5 insertions(+) > > diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c > index c25097092a06..29ec3ef63edc 100644 > --- a/net/netfilter/ipvs/ip_vs_ctl.c > +++ b/net/netfilter/ipvs/ip_vs_ctl.c > @@ -4090,6 +4090,11 @@ static int __net_init ip_vs_control_net_init_sysctl(struct netns_ipvs *ipvs) > tbl[idx++].data = &ipvs->sysctl_conn_reuse_mode; > tbl[idx++].data = &ipvs->sysctl_schedule_icmp; > tbl[idx++].data = &ipvs->sysctl_ignore_tunneled; > +#ifdef CONFIG_IP_VS_DEBUG > + /* Global sysctls must be ro in non-init netns */ > + if (!net_eq(net, &init_net)) > + tbl[idx++].mode = 0444; > +#endif > > ipvs->sysctl_hdr = register_net_sysctl(net, "net/ipv4/vs", tbl); > if (ipvs->sysctl_hdr == NULL) { > -- > 2.31.1 Regards -- Julian Anastasov <ja@ssi.bg>
On Tue, Oct 12, 2021 at 04:54:37PM +0200, Antoine Tenart wrote: > Because the data pointer of net/ipv4/vs/debug_level is not updated per > netns, it must be marked as read-only in non-init netns. Applied, thanks
On Tue, Oct 12, 2021 at 11:48:52PM +0300, Julian Anastasov wrote: > > Hello, > > On Tue, 12 Oct 2021, Antoine Tenart wrote: > > > Because the data pointer of net/ipv4/vs/debug_level is not updated per > > netns, it must be marked as read-only in non-init netns. > > > > Fixes: c6d2d445d8de ("IPVS: netns, final patch enabling network name space.") > > Signed-off-by: Antoine Tenart <atenart@kernel.org> > > Looks good to me, thanks! > > Acked-by: Julian Anastasov <ja@ssi.bg> Likewise, thanks. Acked-by: Simon Horman <horms@verge.net.au> Pablo, please consider picking up this patch.
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c index c25097092a06..29ec3ef63edc 100644 --- a/net/netfilter/ipvs/ip_vs_ctl.c +++ b/net/netfilter/ipvs/ip_vs_ctl.c @@ -4090,6 +4090,11 @@ static int __net_init ip_vs_control_net_init_sysctl(struct netns_ipvs *ipvs) tbl[idx++].data = &ipvs->sysctl_conn_reuse_mode; tbl[idx++].data = &ipvs->sysctl_schedule_icmp; tbl[idx++].data = &ipvs->sysctl_ignore_tunneled; +#ifdef CONFIG_IP_VS_DEBUG + /* Global sysctls must be ro in non-init netns */ + if (!net_eq(net, &init_net)) + tbl[idx++].mode = 0444; +#endif ipvs->sysctl_hdr = register_net_sysctl(net, "net/ipv4/vs", tbl); if (ipvs->sysctl_hdr == NULL) {
Because the data pointer of net/ipv4/vs/debug_level is not updated per netns, it must be marked as read-only in non-init netns. Fixes: c6d2d445d8de ("IPVS: netns, final patch enabling network name space.") Signed-off-by: Antoine Tenart <atenart@kernel.org> --- net/netfilter/ipvs/ip_vs_ctl.c | 5 +++++ 1 file changed, 5 insertions(+)