Commit 2b696a2a authored by Alexander Mikhalitsyn's avatar Alexander Mikhalitsyn Committed by David S. Miller
Browse files

ipvs: allow some sysctls in non-init user namespaces 

Let's make all IPVS sysctls writtable even when
network namespace is owned by non-initial user namespace.

Let's make a few sysctls to be read-only for non-privileged users:
- sync_qlen_max
- sync_sock_size
- run_estimation
- est_cpulist
- est_nice

I'm trying to be conservative with this to prevent
introducing any security issues in there. Maybe,
we can allow more sysctls to be writable, but let's
do this on-demand and when we see real use-case.

This patch is motivated by user request in the LXC
project [1]. Having this can help with running some
Kubernetes [2] or Docker Swarm [3] workloads inside the system
containers.

Link: https://github.com/lxc/lxc/issues/4278 [1]
Link: https://github.com/kubernetes/kubernetes/blob/b722d017a34b300a2284b890448e5a605f21d01e/pkg/proxy/ipvs/proxier.go#L103 [2]
Link: https://github.com/moby/libnetwork/blob/3797618f9a38372e8107d8c06f6ae199e1133ae8/osl/namespace_linux.go#L682

 [3]

Cc: Julian Anastasov <ja@ssi.bg>
Cc: Simon Horman <horms@verge.net.au>
Cc: Pablo Neira Ayuso <pablo@netfilter.org>
Cc: Jozsef Kadlecsik <kadlec@netfilter.org>
Cc: Florian Westphal <fw@strlen.de>
Signed-off-by: default avatarAlexander Mikhalitsyn <aleksandr.mikhalitsyn@canonical.com>
Acked-by: default avatarJulian Anastasov <ja@ssi.bg>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 643bb5db

net/netfilter/ipvs/ip_vs_ctl.c

+15 −4
Original line number Diff line number Diff line
@@ -4269,6 +4269,7 @@ static int __net_init ip_vs_control_net_init_sysctl(struct netns_ipvs *ipvs) 
	struct ctl_table *tbl;

	int idx, ret;

	size_t ctl_table_size = ARRAY_SIZE(vs_vars);

	bool unpriv = net->user_ns != &init_user_ns;



	atomic_set(&ipvs->dropentry, 0);

	spin_lock_init(&ipvs->dropentry_lock);
@@ -4283,10 +4284,6 @@ static int __net_init ip_vs_control_net_init_sysctl(struct netns_ipvs *ipvs) 
		tbl = kmemdup(vs_vars, sizeof(vs_vars), GFP_KERNEL);

		if (tbl == NULL)

			return -ENOMEM;



		/* Don't export sysctls to unprivileged users */

		if (net->user_ns != &init_user_ns)

			ctl_table_size = 0;

	} else

		tbl = vs_vars;

	/* Initialize sysctl defaults */
@@ -4312,10 +4309,17 @@ static int __net_init ip_vs_control_net_init_sysctl(struct netns_ipvs *ipvs) 
	ipvs->sysctl_sync_ports = 1;

	tbl[idx++].data = &ipvs->sysctl_sync_ports;

	tbl[idx++].data = &ipvs->sysctl_sync_persist_mode;



	ipvs->sysctl_sync_qlen_max = nr_free_buffer_pages() / 32;

	if (unpriv)

		tbl[idx].mode = 0444;

	tbl[idx++].data = &ipvs->sysctl_sync_qlen_max;



	ipvs->sysctl_sync_sock_size = 0;

	if (unpriv)

		tbl[idx].mode = 0444;

	tbl[idx++].data = &ipvs->sysctl_sync_sock_size;



	tbl[idx++].data = &ipvs->sysctl_cache_bypass;

	tbl[idx++].data = &ipvs->sysctl_expire_nodest_conn;

	tbl[idx++].data = &ipvs->sysctl_sloppy_tcp;
@@ -4338,15 +4342,22 @@ static int __net_init ip_vs_control_net_init_sysctl(struct netns_ipvs *ipvs) 
	tbl[idx++].data = &ipvs->sysctl_conn_reuse_mode;

	tbl[idx++].data = &ipvs->sysctl_schedule_icmp;

	tbl[idx++].data = &ipvs->sysctl_ignore_tunneled;



	ipvs->sysctl_run_estimation = 1;

	if (unpriv)

		tbl[idx].mode = 0444;

	tbl[idx].extra2 = ipvs;

	tbl[idx++].data = &ipvs->sysctl_run_estimation;



	ipvs->est_cpulist_valid = 0;

	if (unpriv)

		tbl[idx].mode = 0444;

	tbl[idx].extra2 = ipvs;

	tbl[idx++].data = &ipvs->sysctl_est_cpulist;



	ipvs->sysctl_est_nice = IPVS_EST_NICE;

	if (unpriv)

		tbl[idx].mode = 0444;

	tbl[idx].extra2 = ipvs;

	tbl[idx++].data = &ipvs->sysctl_est_nice;