diff options
| author | Antoine Tenart <atenart@kernel.org> | 2021-10-12 16:54:37 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-10-27 09:53:12 +0200 |
| commit | a88bf750a4355261ed868151f90703de6b05343b (patch) | |
| tree | 8b796c543b5cfaa24c811c0ba8b47adfb748681e | |
| parent | 0e06bd70979d1cfaf60b5ecfe624aa7354e574e5 (diff) | |
| download | linux-stable-a88bf750a4355261ed868151f90703de6b05343b.tar.gz linux-stable-a88bf750a4355261ed868151f90703de6b05343b.tar.bz2 linux-stable-a88bf750a4355261ed868151f90703de6b05343b.zip | |
netfilter: ipvs: make global sysctl readonly in non-init netns
[ Upstream commit 174c376278949c44aad89c514a6b5db6cee8db59 ]
Because the data pointer of net/ipv4/vs/debug_level is not updated per
netns, it must be marked as read-only in non-init netns.
Fixes: c6d2d445d8de ("IPVS: netns, final patch enabling network name space.")
Signed-off-by: Antoine Tenart <atenart@kernel.org>
Acked-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | net/netfilter/ipvs/ip_vs_ctl.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c index 6208fa09fe71..3bf8d7f3cdc3 100644 --- a/net/netfilter/ipvs/ip_vs_ctl.c +++ b/net/netfilter/ipvs/ip_vs_ctl.c @@ -3955,6 +3955,11 @@ static int __net_init ip_vs_control_net_init_sysctl(struct netns_ipvs *ipvs) tbl[idx++].data = &ipvs->sysctl_conn_reuse_mode; tbl[idx++].data = &ipvs->sysctl_schedule_icmp; tbl[idx++].data = &ipvs->sysctl_ignore_tunneled; +#ifdef CONFIG_IP_VS_DEBUG + /* Global sysctls must be ro in non-init netns */ + if (!net_eq(net, &init_net)) + tbl[idx++].mode = 0444; +#endif ipvs->sysctl_hdr = register_net_sysctl(net, "net/ipv4/vs", tbl); if (ipvs->sysctl_hdr == NULL) { |