linux/net
Alexander Mikhalitsyn 2b696a2a10 ipvs: allow some sysctls in non-init user namespaces
Let's make all IPVS sysctls writtable even when
network namespace is owned by non-initial user namespace.

Let's make a few sysctls to be read-only for non-privileged users:
- sync_qlen_max
- sync_sock_size
- run_estimation
- est_cpulist
- est_nice

I'm trying to be conservative with this to prevent
introducing any security issues in there. Maybe,
we can allow more sysctls to be writable, but let's
do this on-demand and when we see real use-case.

This patch is motivated by user request in the LXC
project [1]. Having this can help with running some
Kubernetes [2] or Docker Swarm [3] workloads inside the system
containers.

Link: https://github.com/lxc/lxc/issues/4278 [1]
Link: b722d017a3/pkg/proxy/ipvs/proxier.go (L103) [2]
Link: 3797618f9a/osl/namespace_linux.go (L682) [3]

Cc: Julian Anastasov <ja@ssi.bg>
Cc: Simon Horman <horms@verge.net.au>
Cc: Pablo Neira Ayuso <pablo@netfilter.org>
Cc: Jozsef Kadlecsik <kadlec@netfilter.org>
Cc: Florian Westphal <fw@strlen.de>
Signed-off-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@canonical.com>
Acked-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: David S. Miller <davem@davemloft.net>
2024-05-08 12:22:18 +01:00
..
6lowpan
9p
802
8021q net: annotate writes on dev->mtu from ndo_change_mtu() 2024-05-07 16:19:14 -07:00
appletalk appletalk: Remove the now superfluous sentinel elements from ctl_table array 2024-05-03 13:29:42 +01:00
atm inet: introduce dst_rtable() helper 2024-04-30 18:32:38 -07:00
ax25 ax.25: x.25: Remove the now superfluous sentinel elements from ctl_table array 2024-05-03 13:29:43 +01:00
batman-adv net: annotate writes on dev->mtu from ndo_change_mtu() 2024-05-07 16:19:14 -07:00
bluetooth ipv6: introduce dst_rt6_info() helper 2024-04-29 13:32:01 +01:00
bpf bpf: check bpf_dummy_struct_ops program params for test runs 2024-04-25 12:42:43 -07:00
bridge net: annotate writes on dev->mtu from ndo_change_mtu() 2024-05-07 16:19:14 -07:00
caif caif: Use UTILITY_NAME_LENGTH instead of hard-coding 16 2024-04-02 18:20:00 -07:00
can
ceph
core net: add IEEE 802.1q specific helpers 2024-05-08 10:35:09 +01:00
dcb
dccp net: dccp: Fix ccid2_rtt_estimator() kernel-doc 2024-05-07 16:15:08 -07:00
devlink devlink: extend devlink_param *set pointer 2024-04-22 13:05:19 -07:00
dns_resolver
dsa net: dsa: add support switches global DSCP priority mapping 2024-05-08 10:35:10 +01:00
ethernet ethernet: Add helper for assigning packet type when dest address does not match device address 2024-04-25 08:20:54 -07:00
ethtool net: ethtool: pse-pd: Expand pse commands with the PSE PoE interface 2024-04-18 18:27:02 -07:00
handshake net/handshake: remove redundant assignment to variable ret 2024-04-16 17:14:55 -07:00
hsr net: annotate writes on dev->mtu from ndo_change_mtu() 2024-05-07 16:19:14 -07:00
ieee802154 net: Remove the now superfluous sentinel elements from ctl_table array 2024-05-03 13:29:41 +01:00
ife
ipv4 net/ipv4: add tracepoint for icmp_send 2024-05-08 10:39:26 +01:00
ipv6 net: annotate writes on dev->mtu from ndo_change_mtu() 2024-05-07 16:19:14 -07:00
iucv net/iucv: Avoid explicit cpumask var allocation on stack 2024-04-02 18:19:09 -07:00
kcm net: kcm: fix incorrect parameter validation in the kcm_getsockopt) function 2024-03-11 09:53:22 +00:00
key
l2tp Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2024-05-02 12:06:25 -07:00
l3mdev
lapb
llc net: Remove ctl_table sentinel elements from several networking subsystems 2024-05-03 13:29:42 +01:00
mac80211 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2024-04-25 12:41:37 -07:00
mac802154
mctp
mpls net: Remove the now superfluous sentinel elements from ctl_table array 2024-05-03 13:29:41 +01:00
mptcp mptcp: fix possible NULL dereferences 2024-05-07 16:36:26 -07:00
ncsi
netfilter ipvs: allow some sysctls in non-init user namespaces 2024-05-08 12:22:18 +01:00
netlabel
netlink netlink: support all extack types in dumps 2024-04-23 10:09:49 -07:00
netrom net: Remove ctl_table sentinel elements from several networking subsystems 2024-05-03 13:29:42 +01:00
nfc net: nfc: remove inappropriate attrs check 2024-04-12 18:52:35 -07:00
nsh nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment(). 2024-04-26 12:20:01 +02:00
openvswitch Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2024-04-25 12:41:37 -07:00
packet af_packet: avoid a false positive warning in packet_setsockopt() 2024-04-08 13:19:01 +01:00
phonet net: Remove ctl_table sentinel elements from several networking subsystems 2024-05-03 13:29:42 +01:00
psample ip_tunnel: convert __be16 tunnel flags to bitmaps 2024-04-01 10:49:28 +01:00
qrtr
rds net: rds: Remove the now superfluous sentinel elements from ctl_table array 2024-05-03 13:29:42 +01:00
rfkill net: rfkill: gpio: Convert to platform remove callback returning void 2024-03-25 15:40:22 +01:00
rose net: Remove ctl_table sentinel elements from several networking subsystems 2024-05-03 13:29:42 +01:00
rxrpc net: Remove ctl_table sentinel elements from several networking subsystems 2024-05-03 13:29:42 +01:00
sched net: annotate writes on dev->mtu from ndo_change_mtu() 2024-05-07 16:19:14 -07:00
sctp net: Remove ctl_table sentinel elements from several networking subsystems 2024-05-03 13:29:42 +01:00
smc net: Remove ctl_table sentinel elements from several networking subsystems 2024-05-03 13:29:42 +01:00
strparser
sunrpc net: sunrpc: Remove the now superfluous sentinel elements from ctl_table array 2024-05-03 13:29:42 +01:00
switchdev net: bridge: switchdev: Improve error message for port_obj_add/del functions 2024-05-08 12:19:12 +01:00
tipc net: Remove ctl_table sentinel elements from several networking subsystems 2024-05-03 13:29:42 +01:00
tls Revert "net: mirror skb frag ref/unref helpers" 2024-05-03 16:05:53 -07:00
unix net: Remove the now superfluous sentinel elements from ctl_table array 2024-05-03 13:29:41 +01:00
vmw_vsock vsock/virtio: fix packet delivery to tap device 2024-04-02 18:00:24 -07:00
wireless Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2024-04-25 12:41:37 -07:00
x25 ax.25: x.25: Remove the now superfluous sentinel elements from ctl_table array 2024-05-03 13:29:43 +01:00
xdp xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING 2024-04-05 22:47:22 -07:00
xfrm rtnetlink: allow rtnl_fill_link_netnsid() to run under RCU protection 2024-05-07 11:14:50 +02:00
compat.c
devres.c
Kconfig net: add IEEE 802.1q specific helpers 2024-05-08 10:35:09 +01:00
Kconfig.debug
Makefile
socket.c net: remove {revc,send}msg_copy_msghdr() from exports 2024-03-14 16:48:53 -07:00
sysctl_net.c