lkml.org 
[lkml]   [2022]   [Jan]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 4.19 23/59] net: Enable neighbor sysctls that is save for userns root
    Date
    From: xu xin <xu.xin16@zte.com.cn>

    [ Upstream commit 8c8b7aa7fb0cf9e1cc9204e6bc6e1353b8393502 ]

    Inside netns owned by non-init userns, sysctls about ARP/neighbor is
    currently not visible and configurable.

    For the attributes these sysctls correspond to, any modifications make
    effects on the performance of networking(ARP, especilly) only in the
    scope of netns, which does not affect other netns.

    Actually, some tools via netlink can modify these attribute. iproute2 is
    an example. see as follows:

    $ unshare -ur -n
    $ cat /proc/sys/net/ipv4/neigh/lo/retrans_time
    cat: can't open '/proc/sys/net/ipv4/neigh/lo/retrans_time': No such file
    or directory
    $ ip ntable show dev lo
    inet arp_cache
    dev lo
    refcnt 1 reachable 19494 base_reachable 30000 retrans 1000
    gc_stale 60000 delay_probe 5000 queue 101
    app_probes 0 ucast_probes 3 mcast_probes 3
    anycast_delay 1000 proxy_delay 800 proxy_queue 64 locktime 1000

    inet6 ndisc_cache
    dev lo
    refcnt 1 reachable 42394 base_reachable 30000 retrans 1000
    gc_stale 60000 delay_probe 5000 queue 101
    app_probes 0 ucast_probes 3 mcast_probes 3
    anycast_delay 1000 proxy_delay 800 proxy_queue 64 locktime 0
    $ ip ntable change name arp_cache dev <if> retrans 2000
    inet arp_cache
    dev lo
    refcnt 1 reachable 22917 base_reachable 30000 retrans 2000
    gc_stale 60000 delay_probe 5000 queue 101
    app_probes 0 ucast_probes 3 mcast_probes 3
    anycast_delay 1000 proxy_delay 800 proxy_queue 64 locktime 1000

    inet6 ndisc_cache
    dev lo
    refcnt 1 reachable 35524 base_reachable 30000 retrans 1000
    gc_stale 60000 delay_probe 5000 queue 101
    app_probes 0 ucast_probes 3 mcast_probes 3
    anycast_delay 1000 proxy_delay 800 proxy_queue 64 locktime 0

    Reported-by: Zeal Robot <zealci@zte.com.cn>
    Signed-off-by: xu xin <xu.xin16@zte.com.cn>
    Acked-by: Joanne Koong <joannekoong@fb.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/core/neighbour.c | 4 ----
    1 file changed, 4 deletions(-)

    diff --git a/net/core/neighbour.c b/net/core/neighbour.c
    index 6233e9856016e..4c49e4ddabff7 100644
    --- a/net/core/neighbour.c
    +++ b/net/core/neighbour.c
    @@ -3239,10 +3239,6 @@ int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
    neigh_proc_base_reachable_time;
    }

    - /* Don't export sysctls to unprivileged users */
    - if (neigh_parms_net(p)->user_ns != &init_user_ns)
    - t->neigh_vars[0].procname = NULL;
    -
    switch (neigh_parms_family(p)) {
    case AF_INET:
    p_name = "ipv4";
    --
    2.34.1
    \
     
     \ /
      Last update: 2022-01-18 04:27    [W:4.548 / U:0.052 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site