[PATCH] netfilter: conntrack: Make global sysctls readonly in non-init netns

[PATCH] netfilter: conntrack: Make global sysctls readonly in non-init netns

[Jonathon Reinhart]

commit 2671fa4dc0109d3fb581bc3078fdf17b5d9080f6 upstream.

These sysctls point to global variables:
- [0] "nf_conntrack_max"        (&nf_conntrack_max)
- [2] "nf_conntrack_buckets"    (&nf_conntrack_htable_size_user)
- [5] "nf_conntrack_expect_max" (&nf_ct_expect_max)

Because their data pointers are not updated to point to per-netns
structures, they must be marked read-only in a non-init_net ns.
Otherwise, changes in any net namespace are reflected in (leaked into)
all other net namespaces. This problem has existed since the
introduction of net namespaces.

This patch is necessarily different from the upstream patch due to the
heavy refactoring which took place since 4.19:

d0febd81ae77 ("netfilter: conntrack: re-visit sysctls in unprivileged namespaces")
b884fa461776 ("netfilter: conntrack: unify sysctl handling")
4a65798a9408 ("netfilter: conntrack: add mnemonics for sysctl table")

Signed-off-by: Jonathon Reinhart <jonathon.reinhart@gmail.com>
---

Upstream commit 2671fa4dc010 was already applied to the 5.10, 5.11, and
5.12 trees.

This was tested on 4.19.190, so please apply to 4.19.y.

It should also apply to:
- 4.14.y
- 4.9.y

Note that 5.4.y would require a slightly different patch that looks more
like 2671fa4dc010.

---
 net/netfilter/nf_conntrack_standalone.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
index 2e3ae494f369..da0c9fa381d2 100644
--- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c
@@ -594,8 +594,11 @@ static int nf_conntrack_standalone_init_sysctl(struct net *net)
 	if (net->user_ns != &init_user_ns)
 		table[0].procname = NULL;
 
-	if (!net_eq(&init_net, net))
+	if (!net_eq(&init_net, net)) {
+		table[0].mode = 0444;
 		table[2].mode = 0444;
+		table[5].mode = 0444;
+	}
 
 	net->ct.sysctl_header = register_net_sysctl(net, "net/netfilter", table);
 	if (!net->ct.sysctl_header)
-- 
2.20.1

Re: [PATCH] netfilter: conntrack: Make global sysctls readonly in non-init netns

[Greg KH]

On Thu, May 13, 2021 at 04:28:35AM -0400, Jonathon Reinhart wrote:
> commit 2671fa4dc0109d3fb581bc3078fdf17b5d9080f6 upstream.
> 
> These sysctls point to global variables:
> - [0] "nf_conntrack_max"        (&nf_conntrack_max)
> - [2] "nf_conntrack_buckets"    (&nf_conntrack_htable_size_user)
> - [5] "nf_conntrack_expect_max" (&nf_ct_expect_max)
> 
> Because their data pointers are not updated to point to per-netns
> structures, they must be marked read-only in a non-init_net ns.
> Otherwise, changes in any net namespace are reflected in (leaked into)
> all other net namespaces. This problem has existed since the
> introduction of net namespaces.
> 
> This patch is necessarily different from the upstream patch due to the
> heavy refactoring which took place since 4.19:
> 
> d0febd81ae77 ("netfilter: conntrack: re-visit sysctls in unprivileged namespaces")
> b884fa461776 ("netfilter: conntrack: unify sysctl handling")
> 4a65798a9408 ("netfilter: conntrack: add mnemonics for sysctl table")
> 
> Signed-off-by: Jonathon Reinhart <jonathon.reinhart@gmail.com>
> ---
> 
> Upstream commit 2671fa4dc010 was already applied to the 5.10, 5.11, and
> 5.12 trees.
> 
> This was tested on 4.19.190, so please apply to 4.19.y.
> 
> It should also apply to:
> - 4.14.y
> - 4.9.y
> 
> Note that 5.4.y would require a slightly different patch that looks more
> like 2671fa4dc010.

All now queued up, thanks!

greg k-h

[PATCH] netfilter: conntrack: Make global sysctls readonly in non-init netns

[Jonathon Reinhart]

commit 2671fa4dc0109d3fb581bc3078fdf17b5d9080f6 upstream.

These sysctls point to global variables:
- NF_SYSCTL_CT_MAX (&nf_conntrack_max)
- NF_SYSCTL_CT_EXPECT_MAX (&nf_ct_expect_max)
- NF_SYSCTL_CT_BUCKETS (&nf_conntrack_htable_size_user)

Because their data pointers are not updated to point to per-netns
structures, they must be marked read-only in a non-init_net ns.
Otherwise, changes in any net namespace are reflected in (leaked into)
all other net namespaces. This problem has existed since the
introduction of net namespaces.

This patch is necessarily different from the upstream patch due to the
refactoring which took place since 5.4 in commit d0febd81ae77
("netfilter: conntrack: re-visit sysctls in unprivileged namespaces").

Signed-off-by: Jonathon Reinhart <jonathon.reinhart@gmail.com>
---

Upstream commit 2671fa4dc010 was already applied to the 5.10, 5.11, and
5.12 trees.

This was tested on 5.4.118, so please apply to 5.4.y.
---
 net/netfilter/nf_conntrack_standalone.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
index 1a6982540126..46e3c9f5f4ce 100644
--- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c
@@ -1071,8 +1071,11 @@ static int nf_conntrack_standalone_init_sysctl(struct net *net)
 #endif
 	}
 
-	if (!net_eq(&init_net, net))
+	if (!net_eq(&init_net, net)) {
+		table[NF_SYSCTL_CT_MAX].mode = 0444;
+		table[NF_SYSCTL_CT_EXPECT_MAX].mode = 0444;
 		table[NF_SYSCTL_CT_BUCKETS].mode = 0444;
+	}
 
 	net->ct.sysctl_header = register_net_sysctl(net, "net/netfilter", table);
 	if (!net->ct.sysctl_header)
-- 
2.20.1