diff options
| author | Christian Brauner <christian@brauner.io> | 2019-06-24 15:29:23 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2019-06-28 14:34:28 -0700 |
| commit | 5cdda5f1d6adde02da591ca2196f20289977dc56 (patch) | |
| tree | 4a26a3696905c50e800abcab1cb7d7e3dc14f4c5 | |
| parent | 65dc5416d4e02d80ce140078c7c1f4e6c8400396 (diff) | |
| download | linux-5cdda5f1d6adde02da591ca2196f20289977dc56.tar.gz linux-5cdda5f1d6adde02da591ca2196f20289977dc56.tar.bz2 linux-5cdda5f1d6adde02da591ca2196f20289977dc56.zip | |
ipv4: enable route flushing in network namespaces
Tools such as vpnc try to flush routes when run inside network
namespaces by writing 1 into /proc/sys/net/ipv4/route/flush. This
currently does not work because flush is not enabled in non-initial
network namespaces.
Since routes are per network namespace it is safe to enable
/proc/sys/net/ipv4/route/flush in there.
Link: https://github.com/lxc/lxd/issues/4257
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | net/ipv4/route.c | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/net/ipv4/route.c b/net/ipv4/route.c index a3e466b6a60c..bbd55c7f6b2e 100644 --- a/net/ipv4/route.c +++ b/net/ipv4/route.c @@ -3326,9 +3326,11 @@ static struct ctl_table ipv4_route_table[] = { { } }; +static const char ipv4_route_flush_procname[] = "flush"; + static struct ctl_table ipv4_route_flush_table[] = { { - .procname = "flush", + .procname = ipv4_route_flush_procname, .maxlen = sizeof(int), .mode = 0200, .proc_handler = ipv4_sysctl_rtcache_flush, @@ -3346,9 +3348,11 @@ static __net_init int sysctl_route_net_init(struct net *net) if (!tbl) goto err_dup; - /* Don't export sysctls to unprivileged users */ - if (net->user_ns != &init_user_ns) - tbl[0].procname = NULL; + /* Don't export non-whitelisted sysctls to unprivileged users */ + if (net->user_ns != &init_user_ns) { + if (tbl[0].procname != ipv4_route_flush_procname) + tbl[0].procname = NULL; + } } tbl[0].extra1 = net; |