lkml.org 
[lkml]   [2021]   [Oct]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 17/95] netfilter: ipvs: make global sysctl readonly in non-init netns
    Date
    From: Antoine Tenart <atenart@kernel.org>

    [ Upstream commit 174c376278949c44aad89c514a6b5db6cee8db59 ]

    Because the data pointer of net/ipv4/vs/debug_level is not updated per
    netns, it must be marked as read-only in non-init netns.

    Fixes: c6d2d445d8de ("IPVS: netns, final patch enabling network name space.")
    Signed-off-by: Antoine Tenart <atenart@kernel.org>
    Acked-by: Julian Anastasov <ja@ssi.bg>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/netfilter/ipvs/ip_vs_ctl.c | 5 +++++
    1 file changed, 5 insertions(+)

    diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
    index c25097092a06..29ec3ef63edc 100644
    --- a/net/netfilter/ipvs/ip_vs_ctl.c
    +++ b/net/netfilter/ipvs/ip_vs_ctl.c
    @@ -4090,6 +4090,11 @@ static int __net_init ip_vs_control_net_init_sysctl(struct netns_ipvs *ipvs)
    tbl[idx++].data = &ipvs->sysctl_conn_reuse_mode;
    tbl[idx++].data = &ipvs->sysctl_schedule_icmp;
    tbl[idx++].data = &ipvs->sysctl_ignore_tunneled;
    +#ifdef CONFIG_IP_VS_DEBUG
    + /* Global sysctls must be ro in non-init netns */
    + if (!net_eq(net, &init_net))
    + tbl[idx++].mode = 0444;
    +#endif

    ipvs->sysctl_hdr = register_net_sysctl(net, "net/ipv4/vs", tbl);
    if (ipvs->sysctl_hdr == NULL) {
    --
    2.33.0


    \
     
     \ /
      Last update: 2021-10-25 21:38    [W:3.908 / U:0.052 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site