* [PATCH net] netfilter: ipvs: make global sysctl readonly in non-init netns
@ 2021-10-12 14:54 Antoine Tenart
2021-10-12 20:48 ` Julian Anastasov
2021-10-14 21:09 ` Pablo Neira Ayuso
0 siblings, 2 replies; 4+ messages in thread
From: Antoine Tenart @ 2021-10-12 14:54 UTC (permalink / raw)
To: davem, kuba, horms, ja, pablo, kadlec, fw
Cc: Antoine Tenart, netdev, netfilter-devel, coreteam
Because the data pointer of net/ipv4/vs/debug_level is not updated per
netns, it must be marked as read-only in non-init netns.
Fixes: c6d2d445d8de ("IPVS: netns, final patch enabling network name space.")
Signed-off-by: Antoine Tenart <atenart@kernel.org>
---
net/netfilter/ipvs/ip_vs_ctl.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index c25097092a06..29ec3ef63edc 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -4090,6 +4090,11 @@ static int __net_init ip_vs_control_net_init_sysctl(struct netns_ipvs *ipvs)
tbl[idx++].data = &ipvs->sysctl_conn_reuse_mode;
tbl[idx++].data = &ipvs->sysctl_schedule_icmp;
tbl[idx++].data = &ipvs->sysctl_ignore_tunneled;
+#ifdef CONFIG_IP_VS_DEBUG
+ /* Global sysctls must be ro in non-init netns */
+ if (!net_eq(net, &init_net))
+ tbl[idx++].mode = 0444;
+#endif
ipvs->sysctl_hdr = register_net_sysctl(net, "net/ipv4/vs", tbl);
if (ipvs->sysctl_hdr == NULL) {
--
2.31.1
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH net] netfilter: ipvs: make global sysctl readonly in non-init netns
2021-10-12 14:54 [PATCH net] netfilter: ipvs: make global sysctl readonly in non-init netns Antoine Tenart
@ 2021-10-12 20:48 ` Julian Anastasov
2021-10-17 12:18 ` Simon Horman
2021-10-14 21:09 ` Pablo Neira Ayuso
1 sibling, 1 reply; 4+ messages in thread
From: Julian Anastasov @ 2021-10-12 20:48 UTC (permalink / raw)
To: Antoine Tenart
Cc: davem, kuba, horms, pablo, kadlec, fw, netdev, netfilter-devel,
coreteam
Hello,
On Tue, 12 Oct 2021, Antoine Tenart wrote:
> Because the data pointer of net/ipv4/vs/debug_level is not updated per
> netns, it must be marked as read-only in non-init netns.
>
> Fixes: c6d2d445d8de ("IPVS: netns, final patch enabling network name space.")
> Signed-off-by: Antoine Tenart <atenart@kernel.org>
Looks good to me, thanks!
Acked-by: Julian Anastasov <ja@ssi.bg>
> ---
> net/netfilter/ipvs/ip_vs_ctl.c | 5 +++++
> 1 file changed, 5 insertions(+)
>
> diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
> index c25097092a06..29ec3ef63edc 100644
> --- a/net/netfilter/ipvs/ip_vs_ctl.c
> +++ b/net/netfilter/ipvs/ip_vs_ctl.c
> @@ -4090,6 +4090,11 @@ static int __net_init ip_vs_control_net_init_sysctl(struct netns_ipvs *ipvs)
> tbl[idx++].data = &ipvs->sysctl_conn_reuse_mode;
> tbl[idx++].data = &ipvs->sysctl_schedule_icmp;
> tbl[idx++].data = &ipvs->sysctl_ignore_tunneled;
> +#ifdef CONFIG_IP_VS_DEBUG
> + /* Global sysctls must be ro in non-init netns */
> + if (!net_eq(net, &init_net))
> + tbl[idx++].mode = 0444;
> +#endif
>
> ipvs->sysctl_hdr = register_net_sysctl(net, "net/ipv4/vs", tbl);
> if (ipvs->sysctl_hdr == NULL) {
> --
> 2.31.1
Regards
--
Julian Anastasov <ja@ssi.bg>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH net] netfilter: ipvs: make global sysctl readonly in non-init netns
2021-10-12 20:48 ` Julian Anastasov
@ 2021-10-17 12:18 ` Simon Horman
0 siblings, 0 replies; 4+ messages in thread
From: Simon Horman @ 2021-10-17 12:18 UTC (permalink / raw)
To: Julian Anastasov
Cc: Antoine Tenart, davem, kuba, pablo, kadlec, fw, netdev,
netfilter-devel, coreteam
On Tue, Oct 12, 2021 at 11:48:52PM +0300, Julian Anastasov wrote:
>
> Hello,
>
> On Tue, 12 Oct 2021, Antoine Tenart wrote:
>
> > Because the data pointer of net/ipv4/vs/debug_level is not updated per
> > netns, it must be marked as read-only in non-init netns.
> >
> > Fixes: c6d2d445d8de ("IPVS: netns, final patch enabling network name space.")
> > Signed-off-by: Antoine Tenart <atenart@kernel.org>
>
> Looks good to me, thanks!
>
> Acked-by: Julian Anastasov <ja@ssi.bg>
Likewise, thanks.
Acked-by: Simon Horman <horms@verge.net.au>
Pablo, please consider picking up this patch.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH net] netfilter: ipvs: make global sysctl readonly in non-init netns
2021-10-12 14:54 [PATCH net] netfilter: ipvs: make global sysctl readonly in non-init netns Antoine Tenart
2021-10-12 20:48 ` Julian Anastasov
@ 2021-10-14 21:09 ` Pablo Neira Ayuso
1 sibling, 0 replies; 4+ messages in thread
From: Pablo Neira Ayuso @ 2021-10-14 21:09 UTC (permalink / raw)
To: Antoine Tenart
Cc: davem, kuba, horms, ja, kadlec, fw, netdev, netfilter-devel,
coreteam
On Tue, Oct 12, 2021 at 04:54:37PM +0200, Antoine Tenart wrote:
> Because the data pointer of net/ipv4/vs/debug_level is not updated per
> netns, it must be marked as read-only in non-init netns.
Applied, thanks
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2021-10-17 12:18 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2021-10-12 14:54 [PATCH net] netfilter: ipvs: make global sysctl readonly in non-init netns Antoine Tenart
2021-10-12 20:48 ` Julian Anastasov
2021-10-17 12:18 ` Simon Horman
2021-10-14 21:09 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).