mbox series

[net-next,0/2] Ensuring net sysctl isolation

Message ID 20210412042453.32168-1-Jonathon.Reinhart@gmail.com
Headers show
Series Ensuring net sysctl isolation | expand

Message

Jonathon Reinhart April 12, 2021, 4:24 a.m. UTC 
This patchset is the result of an audit of /proc/sys/net to prove that
it is safe to be mouted read-write in a container when a net namespace
is in use. See [1].

The first commit adds code to detect sysctls which are not netns-safe,
and can "leak" changes to other net namespaces.

My manual audit found, and the above feature confirmed, that there are
two nf_conntrack sysctls which are in fact not netns-safe.

I considered sending the latter to netfilter-devel, but I think it's
better to have both together on net-next: Adding only the former causes
undesirable warnings in the kernel log.

[1]: https://github.com/opencontainers/runc/issues/2826

Jonathon Reinhart (2):
  net: Ensure net namespace isolation of sysctls
  netfilter: conntrack: Make global sysctls readonly in non-init netns

 net/netfilter/nf_conntrack_standalone.c | 10 ++----
 net/sysctl_net.c                        | 48 +++++++++++++++++++++++++
 2 files changed, 50 insertions(+), 8 deletions(-)