Re: [PATCH net-next] net: Enable some sysctls for the userns root with privilege

[CGEL <cgel.zte@gmail.com>]

On Mon, Dec 06, 2021 at 04:45:20PM -0800, Jakub Kicinski wrote:
> On Fri,  3 Dec 2021 03:28:15 +0000 cgel.zte@gmail.com wrote:
> > From: xu xin <xu.xin16@zte.com.cn>
> > 
> > Enabled sysctls include the followings: 
> > 1. net/ipv4/neigh/<if>/* 
> > 2. net/ipv6/neigh/<if>/* 
> > 3. net/ieee802154/6lowpan/* 
> > 4. net/ipv6/route/* 
> > 5. net/ipv4/vs/* 
> > 6. net/unix/* 
> > 7. net/core/xfrm_*
> > 
> > In practical work, some userns with root privilege have needs to adjust
> > these sysctls in their own netns, but limited just because they are not
> > init user_ns, even if they are given root privilege by docker -privilege.
> 
> You need to justify why removing these checks is safe. It sounds like
> you're only describing why having the permissions is problematic, which 
> is fair but not sufficient to just remove them.
> 
Hi, Jakub
My patch is a little radical. I just saw Eric's previous reply to
Alexander(https://lore.kernel.org/all/87pmsqyuqy.fsf@disp2133/).
These were disabled because out of an abundance of caution.

My original intention is to enable part of syscyls about neighbor which
I think was safe, but I will try to figure out which of these sysctls
are safe to be enabled.
> > Reported-by: xu xin <xu.xin16@zte.com.cn>
> > Tested-by: xu xin <xu.xin16@zte.com.cn>
> 
> These tags are superfluous for the author of the patch.
> 
Ok. thank you to correct me.
> > Signed-off-by: xu xin <xu.xin16@zte.com.cn>
> > ---
> >  net/core/neighbour.c                | 4 ----
> >  net/ieee802154/6lowpan/reassembly.c | 4 ----
> >  net/ipv6/route.c                    | 4 ----
> >  net/netfilter/ipvs/ip_vs_ctl.c      | 4 ----
> >  net/netfilter/ipvs/ip_vs_lblc.c     | 4 ----
> >  net/netfilter/ipvs/ip_vs_lblcr.c    | 3 ---
> >  net/unix/sysctl_net_unix.c          | 4 ----
> >  net/xfrm/xfrm_sysctl.c              | 4 ----
> >  8 files changed, 31 deletions(-)