Merge branch 'netns-sysctl-isolation'

Browse source

Jonathon Reinhart says:

====================
Ensuring net sysctl isolation

This patchset is the result of an audit of /proc/sys/net to prove that
it is safe to be mouted read-write in a container when a net namespace
is in use. See [1].

The first commit adds code to detect sysctls which are not netns-safe,
and can "leak" changes to other net namespaces.

My manual audit found, and the above feature confirmed, that there are
two nf_conntrack sysctls which are in fact not netns-safe.

I considered sending the latter to netfilter-devel, but I think it's
better to have both together on net-next: Adding only the former causes
undesirable warnings in the kernel log.

[1]: https://github.com/opencontainers/runc/issues/2826
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

...

This commit is contained in:

David S. Miller 2021-04-12 13:27:11 -07:00

parent a115d24a63 2671fa4dc0

commit 645b34a7b5

2 changed files with 50 additions and 8 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

10

net/netfilter/nf_conntrack_standalone.c

View file

48

net/sysctl_net.c

View file