Let's make all IPVS sysctls visible and RO even when network namespace is owned by non-initial user namespace. Let's make a few sysctls to be writable: - conntrack - conn_reuse_mode - expire_nodest_conn - expire_quiescent_template I'm trying to be conservative with this to prevent introducing any security issues in there. Maybe, we can allow more sysctls to be writable, but let's do this on-demand and when we see real use-case. This list of sysctls was chosen because I can't see any security risks allowing them and also Kubernetes uses [2] these specific sysctls. This patch is motivated by user request in the LXC project [1]. [1] https://github.com/lxc/lxc/issues/4278 [2] https://github.com/kubernetes/kubernetes/blob/b722d017a34b300a2284b890448e5a605f21d01e/pkg/proxy/ipvs/proxier.go#L103 Cc: Stéphane Graber <stgraber@xxxxxxxxxxxx> Cc: Christian Brauner <brauner@xxxxxxxxxx> Cc: Julian Anastasov <ja@xxxxxx> Cc: Simon Horman <horms@xxxxxxxxxxxx> Cc: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> Cc: Jozsef Kadlecsik <kadlec@xxxxxxxxxxxxx> Cc: Florian Westphal <fw@xxxxxxxxx> Signed-off-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@xxxxxxxxxxxxx> --- net/netfilter/ipvs/ip_vs_ctl.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c index 143a341bbc0a..92a818c2f783 100644 --- a/net/netfilter/ipvs/ip_vs_ctl.c +++ b/net/netfilter/ipvs/ip_vs_ctl.c @@ -4285,10 +4285,22 @@ static int __net_init ip_vs_control_net_init_sysctl(struct netns_ipvs *ipvs) if (tbl == NULL) return -ENOMEM; - /* Don't export sysctls to unprivileged users */ + /* Let's show all sysctls in non-init user namespace-owned + * net namespaces, but make them read-only. + * + * Allow only a few specific sysctls to be writable. + */ if (net->user_ns != &init_user_ns) { - tbl[0].procname = NULL; - ctl_table_size = 0; + for (idx = 0; idx < ARRAY_SIZE(vs_vars); idx++) { + if (!tbl[idx].procname) + continue; + + if (!((strcmp(tbl[idx].procname, "conntrack") == 0) || + (strcmp(tbl[idx].procname, "conn_reuse_mode") == 0) || + (strcmp(tbl[idx].procname, "expire_nodest_conn") == 0) || + (strcmp(tbl[idx].procname, "expire_quiescent_template") == 0))) + tbl[idx].mode = 0444; + } } } else tbl = vs_vars; -- 2.34.1
