diff options
author | David S. Miller <davem@davemloft.net> | 2021-04-12 13:27:11 -0700 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2021-04-12 13:27:11 -0700 |
commit | 645b34a7b544686d82c6a082bc78df33c322cae9 (patch) | |
tree | 4f871cebe602618f0bf13b51746d9499c9b7cca9 /drivers/net/ethernet/ibm | |
parent | a115d24a636e892ddd1ae58f8e23c78a0390cb68 (diff) | |
parent | 2671fa4dc0109d3fb581bc3078fdf17b5d9080f6 (diff) | |
download | linux-stable-645b34a7b544686d82c6a082bc78df33c322cae9.tar.gz linux-stable-645b34a7b544686d82c6a082bc78df33c322cae9.tar.bz2 linux-stable-645b34a7b544686d82c6a082bc78df33c322cae9.zip |
Merge branch 'netns-sysctl-isolation'
Jonathon Reinhart says:
====================
Ensuring net sysctl isolation
This patchset is the result of an audit of /proc/sys/net to prove that
it is safe to be mouted read-write in a container when a net namespace
is in use. See [1].
The first commit adds code to detect sysctls which are not netns-safe,
and can "leak" changes to other net namespaces.
My manual audit found, and the above feature confirmed, that there are
two nf_conntrack sysctls which are in fact not netns-safe.
I considered sending the latter to netfilter-devel, but I think it's
better to have both together on net-next: Adding only the former causes
undesirable warnings in the kernel log.
[1]: https://github.com/opencontainers/runc/issues/2826
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/ethernet/ibm')
0 files changed, 0 insertions, 0 deletions