[net-next,0/2] Ensuring net sysctl isolation

Message

Jonathon Reinhart April 12, 2021, 4:24 a.m. UTC

This patchset is the result of an audit of /proc/sys/net to prove that
it is safe to be mouted read-write in a container when a net namespace
is in use. See [1].

The first commit adds code to detect sysctls which are not netns-safe,
and can "leak" changes to other net namespaces.

My manual audit found, and the above feature confirmed, that there are
two nf_conntrack sysctls which are in fact not netns-safe.

I considered sending the latter to netfilter-devel, but I think it's
better to have both together on net-next: Adding only the former causes
undesirable warnings in the kernel log.

[1]: https://github.com/opencontainers/runc/issues/2826

Jonathon Reinhart (2):
  net: Ensure net namespace isolation of sysctls
  netfilter: conntrack: Make global sysctls readonly in non-init netns

 net/netfilter/nf_conntrack_standalone.c | 10 ++----
 net/sysctl_net.c                        | 48 +++++++++++++++++++++++++
 2 files changed, 50 insertions(+), 8 deletions(-)

Comments

[e-mail] April 12, 2021, 8:30 p.m. UTC | #1

Hello:

This series was applied to netdev/net-next.git (refs/heads/master):

On Mon, 12 Apr 2021 00:24:51 -0400 you wrote:
> This patchset is the result of an audit of /proc/sys/net to prove that
> it is safe to be mouted read-write in a container when a net namespace
> is in use. See [1].
> 
> The first commit adds code to detect sysctls which are not netns-safe,
> and can "leak" changes to other net namespaces.
> 
> [...]

Here is the summary with links:
  - [net-next,1/2] net: Ensure net namespace isolation of sysctls
    https://git.kernel.org/netdev/net-next/c/31c4d2f160eb
  - [net-next,2/2] netfilter: conntrack: Make global sysctls readonly in non-init netns
    https://git.kernel.org/netdev/net-next/c/2671fa4dc010

You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html