* [PATCH net-next] net: Enable neighbor sysctls that is save for userns root
@ 2021-12-08 8:58 cgel.zte
2021-12-10 19:38 ` Joanne Koong
2021-12-12 12:40 ` patchwork-bot+netdevbpf
0 siblings, 2 replies; 3+ messages in thread
From: cgel.zte @ 2021-12-08 8:58 UTC (permalink / raw)
To: davem; +Cc: kuba, ebiederm, linux-kernel, netdev, daniel, xu xin, Zeal Robot
From: xu xin <xu.xin16@zte.com.cn>
Inside netns owned by non-init userns, sysctls about ARP/neighbor is
currently not visible and configurable.
For the attributes these sysctls correspond to, any modifications make
effects on the performance of networking(ARP, especilly) only in the
scope of netns, which does not affect other netns.
Actually, some tools via netlink can modify these attribute. iproute2 is
an example. see as follows:
$ unshare -ur -n
$ cat /proc/sys/net/ipv4/neigh/lo/retrans_time
cat: can't open '/proc/sys/net/ipv4/neigh/lo/retrans_time': No such file
or directory
$ ip ntable show dev lo
inet arp_cache
dev lo
refcnt 1 reachable 19494 base_reachable 30000 retrans 1000
gc_stale 60000 delay_probe 5000 queue 101
app_probes 0 ucast_probes 3 mcast_probes 3
anycast_delay 1000 proxy_delay 800 proxy_queue 64 locktime 1000
inet6 ndisc_cache
dev lo
refcnt 1 reachable 42394 base_reachable 30000 retrans 1000
gc_stale 60000 delay_probe 5000 queue 101
app_probes 0 ucast_probes 3 mcast_probes 3
anycast_delay 1000 proxy_delay 800 proxy_queue 64 locktime 0
$ ip ntable change name arp_cache dev <if> retrans 2000
inet arp_cache
dev lo
refcnt 1 reachable 22917 base_reachable 30000 retrans 2000
gc_stale 60000 delay_probe 5000 queue 101
app_probes 0 ucast_probes 3 mcast_probes 3
anycast_delay 1000 proxy_delay 800 proxy_queue 64 locktime 1000
inet6 ndisc_cache
dev lo
refcnt 1 reachable 35524 base_reachable 30000 retrans 1000
gc_stale 60000 delay_probe 5000 queue 101
app_probes 0 ucast_probes 3 mcast_probes 3
anycast_delay 1000 proxy_delay 800 proxy_queue 64 locktime 0
Reported-by: Zeal Robot <zealci@zte.com.cn>
Signed-off-by: xu xin <xu.xin16@zte.com.cn>
---
net/core/neighbour.c | 4 ----
1 file changed, 4 deletions(-)
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 0cdd4d9ad942..44d90cc341ea 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -3771,10 +3771,6 @@ int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
neigh_proc_base_reachable_time;
}
- /* Don't export sysctls to unprivileged users */
- if (neigh_parms_net(p)->user_ns != &init_user_ns)
- t->neigh_vars[0].procname = NULL;
-
switch (neigh_parms_family(p)) {
case AF_INET:
p_name = "ipv4";
--
2.25.1
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH net-next] net: Enable neighbor sysctls that is save for userns root
2021-12-08 8:58 [PATCH net-next] net: Enable neighbor sysctls that is save for userns root cgel.zte
@ 2021-12-10 19:38 ` Joanne Koong
2021-12-12 12:40 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 3+ messages in thread
From: Joanne Koong @ 2021-12-10 19:38 UTC (permalink / raw)
To: cgel.zte, davem
Cc: kuba, ebiederm, linux-kernel, netdev, daniel, xu xin, Zeal Robot
On 12/8/21 12:58 AM, cgel.zte@gmail.com wrote:
> From: xu xin <xu.xin16@zte.com.cn>
>
> Inside netns owned by non-init userns, sysctls about ARP/neighbor is
> currently not visible and configurable.
>
> For the attributes these sysctls correspond to, any modifications make
> effects on the performance of networking(ARP, especilly) only in the
> scope of netns, which does not affect other netns.
>
> Actually, some tools via netlink can modify these attribute. iproute2 is
> an example. see as follows:
>
> $ unshare -ur -n
> $ cat /proc/sys/net/ipv4/neigh/lo/retrans_time
> cat: can't open '/proc/sys/net/ipv4/neigh/lo/retrans_time': No such file
> or directory
> $ ip ntable show dev lo
> inet arp_cache
> dev lo
> refcnt 1 reachable 19494 base_reachable 30000 retrans 1000
> gc_stale 60000 delay_probe 5000 queue 101
> app_probes 0 ucast_probes 3 mcast_probes 3
> anycast_delay 1000 proxy_delay 800 proxy_queue 64 locktime 1000
>
> inet6 ndisc_cache
> dev lo
> refcnt 1 reachable 42394 base_reachable 30000 retrans 1000
> gc_stale 60000 delay_probe 5000 queue 101
> app_probes 0 ucast_probes 3 mcast_probes 3
> anycast_delay 1000 proxy_delay 800 proxy_queue 64 locktime 0
> $ ip ntable change name arp_cache dev <if> retrans 2000
> inet arp_cache
> dev lo
> refcnt 1 reachable 22917 base_reachable 30000 retrans 2000
> gc_stale 60000 delay_probe 5000 queue 101
> app_probes 0 ucast_probes 3 mcast_probes 3
> anycast_delay 1000 proxy_delay 800 proxy_queue 64 locktime 1000
>
> inet6 ndisc_cache
> dev lo
> refcnt 1 reachable 35524 base_reachable 30000 retrans 1000
> gc_stale 60000 delay_probe 5000 queue 101
> app_probes 0 ucast_probes 3 mcast_probes 3
> anycast_delay 1000 proxy_delay 800 proxy_queue 64 locktime 0
>
> Reported-by: Zeal Robot <zealci@zte.com.cn>
> Signed-off-by: xu xin <xu.xin16@zte.com.cn>
> ---
This LGTM. The neighbour sysctls are registered to the net namespace
associated with the neigh_parms. Any changes made to a net namespace
will be locally scoped to that net namespace (changes won't affect any other
net namespace).
There is also no possibility of a non-privileged user namespace messing
up the
net namespace sysctls it shares with its parent user namespace. When a
new user
namespace is created without unsharing the network namespace (eg calling
clone() with CLONE_NEWUSER), the new user namespace shares its
parent's network namespace. Write access is protected by the mode set
in the sysctl ctl_table (and enforced by procfs). Here in the case of
the neighbour
sysctls, 0644 is set for every sysctl; only the user owner has write access.
Acked-by: Joanne Koong <joannekoong@fb.com>
> net/core/neighbour.c | 4 ----
> 1 file changed, 4 deletions(-)
>
> diff --git a/net/core/neighbour.c b/net/core/neighbour.c
> index 0cdd4d9ad942..44d90cc341ea 100644
> --- a/net/core/neighbour.c
> +++ b/net/core/neighbour.c
> @@ -3771,10 +3771,6 @@ int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
> neigh_proc_base_reachable_time;
> }
>
> - /* Don't export sysctls to unprivileged users */
> - if (neigh_parms_net(p)->user_ns != &init_user_ns)
> - t->neigh_vars[0].procname = NULL;
> -
> switch (neigh_parms_family(p)) {
> case AF_INET:
> p_name = "ipv4";
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH net-next] net: Enable neighbor sysctls that is save for userns root
2021-12-08 8:58 [PATCH net-next] net: Enable neighbor sysctls that is save for userns root cgel.zte
2021-12-10 19:38 ` Joanne Koong
@ 2021-12-12 12:40 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 3+ messages in thread
From: patchwork-bot+netdevbpf @ 2021-12-12 12:40 UTC (permalink / raw)
To: CGEL
Cc: davem, kuba, ebiederm, linux-kernel, netdev, daniel, xu.xin16, zealci
Hello:
This patch was applied to netdev/net-next.git (master)
by David S. Miller <davem@davemloft.net>:
On Wed, 8 Dec 2021 08:58:44 +0000 you wrote:
> From: xu xin <xu.xin16@zte.com.cn>
>
> Inside netns owned by non-init userns, sysctls about ARP/neighbor is
> currently not visible and configurable.
>
> For the attributes these sysctls correspond to, any modifications make
> effects on the performance of networking(ARP, especilly) only in the
> scope of netns, which does not affect other netns.
>
> [...]
Here is the summary with links:
- [net-next] net: Enable neighbor sysctls that is save for userns root
https://git.kernel.org/netdev/net-next/c/8c8b7aa7fb0c
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2021-12-12 12:40 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-12-08 8:58 [PATCH net-next] net: Enable neighbor sysctls that is save for userns root cgel.zte
2021-12-10 19:38 ` Joanne Koong
2021-12-12 12:40 ` patchwork-bot+netdevbpf
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).