lkml.org 
[lkml]   [2021]   [Dec]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [PATCH net-next] net: Enable neighbor sysctls that is save for userns root
From
On 12/8/21 12:58 AM, cgel.zte@gmail.com wrote:

> From: xu xin <xu.xin16@zte.com.cn>
>
> Inside netns owned by non-init userns, sysctls about ARP/neighbor is
> currently not visible and configurable.
>
> For the attributes these sysctls correspond to, any modifications make
> effects on the performance of networking(ARP, especilly) only in the
> scope of netns, which does not affect other netns.
>
> Actually, some tools via netlink can modify these attribute. iproute2 is
> an example. see as follows:
>
> $ unshare -ur -n
> $ cat /proc/sys/net/ipv4/neigh/lo/retrans_time
> cat: can't open '/proc/sys/net/ipv4/neigh/lo/retrans_time': No such file
> or directory
> $ ip ntable show dev lo
> inet arp_cache
> dev lo
> refcnt 1 reachable 19494 base_reachable 30000 retrans 1000
> gc_stale 60000 delay_probe 5000 queue 101
> app_probes 0 ucast_probes 3 mcast_probes 3
> anycast_delay 1000 proxy_delay 800 proxy_queue 64 locktime 1000
>
> inet6 ndisc_cache
> dev lo
> refcnt 1 reachable 42394 base_reachable 30000 retrans 1000
> gc_stale 60000 delay_probe 5000 queue 101
> app_probes 0 ucast_probes 3 mcast_probes 3
> anycast_delay 1000 proxy_delay 800 proxy_queue 64 locktime 0
> $ ip ntable change name arp_cache dev <if> retrans 2000
> inet arp_cache
> dev lo
> refcnt 1 reachable 22917 base_reachable 30000 retrans 2000
> gc_stale 60000 delay_probe 5000 queue 101
> app_probes 0 ucast_probes 3 mcast_probes 3
> anycast_delay 1000 proxy_delay 800 proxy_queue 64 locktime 1000
>
> inet6 ndisc_cache
> dev lo
> refcnt 1 reachable 35524 base_reachable 30000 retrans 1000
> gc_stale 60000 delay_probe 5000 queue 101
> app_probes 0 ucast_probes 3 mcast_probes 3
> anycast_delay 1000 proxy_delay 800 proxy_queue 64 locktime 0
>
> Reported-by: Zeal Robot <zealci@zte.com.cn>
> Signed-off-by: xu xin <xu.xin16@zte.com.cn>
> ---
This LGTM. The neighbour sysctls are registered to the net namespace
associated with the neigh_parms. Any changes made to a net namespace
will be locally scoped to that net namespace (changes won't affect any other
net namespace).

There is also no possibility of a non-privileged user namespace messing
up the
net namespace sysctls it shares with its parent user namespace. When a
new user
namespace is created without unsharing the network namespace (eg calling
clone()  with CLONE_NEWUSER), the new user namespace shares its
parent's network namespace. Write access is protected by the mode set
in the sysctl ctl_table (and enforced by procfs). Here in the case of
the neighbour
sysctls, 0644 is set for every sysctl; only the user owner has write access.


Acked-by: Joanne Koong <joannekoong@fb.com>
> net/core/neighbour.c | 4 ----
> 1 file changed, 4 deletions(-)
>
> diff --git a/net/core/neighbour.c b/net/core/neighbour.c
> index 0cdd4d9ad942..44d90cc341ea 100644
> --- a/net/core/neighbour.c
> +++ b/net/core/neighbour.c
> @@ -3771,10 +3771,6 @@ int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
> neigh_proc_base_reachable_time;
> }
>
> - /* Don't export sysctls to unprivileged users */
> - if (neigh_parms_net(p)->user_ns != &init_user_ns)
> - t->neigh_vars[0].procname = NULL;
> -
> switch (neigh_parms_family(p)) {
> case AF_INET:
> p_name = "ipv4";

\
 
 \ /
  Last update: 2021-12-10 20:39    [W:0.058 / U:0.672 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site