Messages in this thread Patch in this message | | | From | Alexander Mikhalitsyn <> | Subject | [PATCH net-next] ipvs: allow some sysctls in non-init user namespaces | Date | Tue, 16 Apr 2024 16:48:14 +0200 |
| |
Let's make all IPVS sysctls visible and RO even when network namespace is owned by non-initial user namespace.
Let's make a few sysctls to be writable: - conntrack - conn_reuse_mode - expire_nodest_conn - expire_quiescent_template
I'm trying to be conservative with this to prevent introducing any security issues in there. Maybe, we can allow more sysctls to be writable, but let's do this on-demand and when we see real use-case.
This list of sysctls was chosen because I can't see any security risks allowing them and also Kubernetes uses [2] these specific sysctls.
This patch is motivated by user request in the LXC project [1].
[1] https://github.com/lxc/lxc/issues/4278 [2] https://github.com/kubernetes/kubernetes/blob/b722d017a34b300a2284b890448e5a605f21d01e/pkg/proxy/ipvs/proxier.go#L103
Cc: Stéphane Graber <stgraber@stgraber.org> Cc: Christian Brauner <brauner@kernel.org> Cc: Julian Anastasov <ja@ssi.bg> Cc: Simon Horman <horms@verge.net.au> Cc: Pablo Neira Ayuso <pablo@netfilter.org> Cc: Jozsef Kadlecsik <kadlec@netfilter.org> Cc: Florian Westphal <fw@strlen.de> Signed-off-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@canonical.com> --- net/netfilter/ipvs/ip_vs_ctl.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-)
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c index 143a341bbc0a..92a818c2f783 100644 --- a/net/netfilter/ipvs/ip_vs_ctl.c +++ b/net/netfilter/ipvs/ip_vs_ctl.c @@ -4285,10 +4285,22 @@ static int __net_init ip_vs_control_net_init_sysctl(struct netns_ipvs *ipvs) if (tbl == NULL) return -ENOMEM; - /* Don't export sysctls to unprivileged users */ + /* Let's show all sysctls in non-init user namespace-owned + * net namespaces, but make them read-only. + * + * Allow only a few specific sysctls to be writable. + */ if (net->user_ns != &init_user_ns) { - tbl[0].procname = NULL; - ctl_table_size = 0; + for (idx = 0; idx < ARRAY_SIZE(vs_vars); idx++) { + if (!tbl[idx].procname) + continue; + + if (!((strcmp(tbl[idx].procname, "conntrack") == 0) || + (strcmp(tbl[idx].procname, "conn_reuse_mode") == 0) || + (strcmp(tbl[idx].procname, "expire_nodest_conn") == 0) || + (strcmp(tbl[idx].procname, "expire_quiescent_template") == 0))) + tbl[idx].mode = 0444; + } } } else tbl = vs_vars; -- 2.34.1
| |