Hello,
On Tue, 12 Oct 2021, Antoine Tenart wrote:
> Because the data pointer of net/ipv4/vs/debug_level is not updated per
> netns, it must be marked as read-only in non-init netns.
>
> Fixes: c6d2d445d8de ("IPVS: netns, final patch enabling network name space.")
> Signed-off-by: Antoine Tenart <atenart@xxxxxxxxxx>
Looks good to me, thanks!
Acked-by: Julian Anastasov <ja@xxxxxx>
> ---
> net/netfilter/ipvs/ip_vs_ctl.c | 5 +++++
> 1 file changed, 5 insertions(+)
>
> diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
> index c25097092a06..29ec3ef63edc 100644
> --- a/net/netfilter/ipvs/ip_vs_ctl.c
> +++ b/net/netfilter/ipvs/ip_vs_ctl.c
> @@ -4090,6 +4090,11 @@ static int __net_init ip_vs_control_net_init_sysctl(struct netns_ipvs *ipvs)
> tbl[idx++].data = &ipvs->sysctl_conn_reuse_mode;
> tbl[idx++].data = &ipvs->sysctl_schedule_icmp;
> tbl[idx++].data = &ipvs->sysctl_ignore_tunneled;
> +#ifdef CONFIG_IP_VS_DEBUG
> + /* Global sysctls must be ro in non-init netns */
> + if (!net_eq(net, &init_net))
> + tbl[idx++].mode = 0444;
> +#endif
>
> ipvs->sysctl_hdr = register_net_sysctl(net, "net/ipv4/vs", tbl);
> if (ipvs->sysctl_hdr == NULL) {
> --
> 2.31.1
Regards
--
Julian Anastasov <ja@xxxxxx>
