lkml.org 
[lkml]   [2021]   [Dec]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [PATCH net-next] net: Enable some sysctls for the userns root with privilege
From
On 12/6/21 11:18 PM, CGEL wrote:

> On Mon, Dec 06, 2021 at 04:45:20PM -0800, Jakub Kicinski wrote:
>> On Fri, 3 Dec 2021 03:28:15 +0000 cgel.zte@gmail.com wrote:
>>> From: xu xin <xu.xin16@zte.com.cn>
>>>
>>> Enabled sysctls include the followings:
>>> 1. net/ipv4/neigh/<if>/*
>>> 2. net/ipv6/neigh/<if>/*
>>> 3. net/ieee802154/6lowpan/*
>>> 4. net/ipv6/route/*
>>> 5. net/ipv4/vs/*
>>> 6. net/unix/*
>>> 7. net/core/xfrm_*
>>>
>>> In practical work, some userns with root privilege have needs to adjust
>>> these sysctls in their own netns, but limited just because they are not
>>> init user_ns, even if they are given root privilege by docker -privilege.
>> You need to justify why removing these checks is safe. It sounds like
>> you're only describing why having the permissions is problematic, which
>> is fair but not sufficient to just remove them.
>>
> Hi, Jakub
> My patch is a little radical. I just saw Eric's previous reply to
> Alexander(https://lore.kernel.org/all/87pmsqyuqy.fsf@disp2133/).
> These were disabled because out of an abundance of caution.
>
> My original intention is to enable part of syscyls about neighbor which
> I think was safe, but I will try to figure out which of these sysctls
> are safe to be enabled.
>

A team at my company has a use case for needing to set the unix sysctls,
so I submitted a patch for enabling the unix sysctl here
https://lore.kernel.org/netdev/20211207202101.2457994-1-joannekoong@fb.com/T/#u

[...]
>>> Signed-off-by: xu xin <xu.xin16@zte.com.cn>
>>> ---
>>> net/core/neighbour.c | 4 ----
>>> net/ieee802154/6lowpan/reassembly.c | 4 ----
>>> net/ipv6/route.c | 4 ----
>>> net/netfilter/ipvs/ip_vs_ctl.c | 4 ----
>>> net/netfilter/ipvs/ip_vs_lblc.c | 4 ----
>>> net/netfilter/ipvs/ip_vs_lblcr.c | 3 ---
>>> net/unix/sysctl_net_unix.c | 4 ----
>>> net/xfrm/xfrm_sysctl.c | 4 ----
>>> 8 files changed, 31 deletions(-)
>

\
 
 \ /
  Last update: 2021-12-07 23:20    [W:0.089 / U:0.052 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site