[PATCH net] netfilter: ipvs: make global sysctl readonly in non-init netns

[PATCH net] netfilter: ipvs: make global sysctl readonly in non-init netns

[Antoine Tenart]

Because the data pointer of net/ipv4/vs/debug_level is not updated per
netns, it must be marked as read-only in non-init netns.

Fixes: c6d2d445d8de ("IPVS: netns, final patch enabling network name space.")
Signed-off-by: Antoine Tenart <atenart@kernel.org>
---
 net/netfilter/ipvs/ip_vs_ctl.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index c25097092a06..29ec3ef63edc 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -4090,6 +4090,11 @@ static int __net_init ip_vs_control_net_init_sysctl(struct netns_ipvs *ipvs)
 	tbl[idx++].data = &ipvs->sysctl_conn_reuse_mode;
 	tbl[idx++].data = &ipvs->sysctl_schedule_icmp;
 	tbl[idx++].data = &ipvs->sysctl_ignore_tunneled;
+#ifdef CONFIG_IP_VS_DEBUG
+	/* Global sysctls must be ro in non-init netns */
+	if (!net_eq(net, &init_net))
+		tbl[idx++].mode = 0444;
+#endif
 
 	ipvs->sysctl_hdr = register_net_sysctl(net, "net/ipv4/vs", tbl);
 	if (ipvs->sysctl_hdr == NULL) {
-- 
2.31.1

Re: [PATCH net] netfilter: ipvs: make global sysctl readonly in non-init netns

[Julian Anastasov]

	Hello,

On Tue, 12 Oct 2021, Antoine Tenart wrote:

> Because the data pointer of net/ipv4/vs/debug_level is not updated per
> netns, it must be marked as read-only in non-init netns.
> 
> Fixes: c6d2d445d8de ("IPVS: netns, final patch enabling network name space.")
> Signed-off-by: Antoine Tenart <atenart@kernel.org>

	Looks good to me, thanks!

Acked-by: Julian Anastasov <ja@ssi.bg>

> ---
>  net/netfilter/ipvs/ip_vs_ctl.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
> index c25097092a06..29ec3ef63edc 100644
> --- a/net/netfilter/ipvs/ip_vs_ctl.c
> +++ b/net/netfilter/ipvs/ip_vs_ctl.c
> @@ -4090,6 +4090,11 @@ static int __net_init ip_vs_control_net_init_sysctl(struct netns_ipvs *ipvs)
>  	tbl[idx++].data = &ipvs->sysctl_conn_reuse_mode;
>  	tbl[idx++].data = &ipvs->sysctl_schedule_icmp;
>  	tbl[idx++].data = &ipvs->sysctl_ignore_tunneled;
> +#ifdef CONFIG_IP_VS_DEBUG
> +	/* Global sysctls must be ro in non-init netns */
> +	if (!net_eq(net, &init_net))
> +		tbl[idx++].mode = 0444;
> +#endif
>  
>  	ipvs->sysctl_hdr = register_net_sysctl(net, "net/ipv4/vs", tbl);
>  	if (ipvs->sysctl_hdr == NULL) {
> -- 
> 2.31.1

Regards

--
Julian Anastasov <ja@ssi.bg>

Re: [PATCH net] netfilter: ipvs: make global sysctl readonly in non-init netns

[Pablo Neira Ayuso]

On Tue, Oct 12, 2021 at 04:54:37PM +0200, Antoine Tenart wrote:
> Because the data pointer of net/ipv4/vs/debug_level is not updated per
> netns, it must be marked as read-only in non-init netns.

Applied, thanks

Re: [PATCH net] netfilter: ipvs: make global sysctl readonly in non-init netns

[Simon Horman]

On Tue, Oct 12, 2021 at 11:48:52PM +0300, Julian Anastasov wrote:
> 
> 	Hello,
> 
> On Tue, 12 Oct 2021, Antoine Tenart wrote:
> 
> > Because the data pointer of net/ipv4/vs/debug_level is not updated per
> > netns, it must be marked as read-only in non-init netns.
> > 
> > Fixes: c6d2d445d8de ("IPVS: netns, final patch enabling network name space.")
> > Signed-off-by: Antoine Tenart <atenart@kernel.org>
> 
> 	Looks good to me, thanks!
> 
> Acked-by: Julian Anastasov <ja@ssi.bg>

Likewise, thanks.

Acked-by: Simon Horman <horms@verge.net.au>

Pablo, please consider picking up this patch.