Re: [PATCH] netfilter: conntrack: Make global sysctls readonly in non-init netns

[Greg KH <gregkh@linuxfoundation.org>]

On Thu, May 13, 2021 at 04:28:35AM -0400, Jonathon Reinhart wrote:
> commit 2671fa4dc0109d3fb581bc3078fdf17b5d9080f6 upstream.
> 
> These sysctls point to global variables:
> - [0] "nf_conntrack_max"        (&nf_conntrack_max)
> - [2] "nf_conntrack_buckets"    (&nf_conntrack_htable_size_user)
> - [5] "nf_conntrack_expect_max" (&nf_ct_expect_max)
> 
> Because their data pointers are not updated to point to per-netns
> structures, they must be marked read-only in a non-init_net ns.
> Otherwise, changes in any net namespace are reflected in (leaked into)
> all other net namespaces. This problem has existed since the
> introduction of net namespaces.
> 
> This patch is necessarily different from the upstream patch due to the
> heavy refactoring which took place since 4.19:
> 
> d0febd81ae77 ("netfilter: conntrack: re-visit sysctls in unprivileged namespaces")
> b884fa461776 ("netfilter: conntrack: unify sysctl handling")
> 4a65798a9408 ("netfilter: conntrack: add mnemonics for sysctl table")
> 
> Signed-off-by: Jonathon Reinhart <jonathon.reinhart@gmail.com>
> ---
> 
> Upstream commit 2671fa4dc010 was already applied to the 5.10, 5.11, and
> 5.12 trees.
> 
> This was tested on 4.19.190, so please apply to 4.19.y.
> 
> It should also apply to:
> - 4.14.y
> - 4.9.y
> 
> Note that 5.4.y would require a slightly different patch that looks more
> like 2671fa4dc010.

All now queued up, thanks!

greg k-h