Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5cdda5f1 authored by Christian Brauner's avatar Christian Brauner Committed by David S. Miller
Browse files

ipv4: enable route flushing in network namespaces 

Tools such as vpnc try to flush routes when run inside network
namespaces by writing 1 into /proc/sys/net/ipv4/route/flush. This
currently does not work because flush is not enabled in non-initial
network namespaces.
Since routes are per network namespace it is safe to enable
/proc/sys/net/ipv4/route/flush in there.

Link: https://github.com/lxc/lxd/issues/4257


Signed-off-by: default avatarChristian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 65dc5416

net/ipv4/route.c

+8 −4
Original line number Diff line number Diff line
@@ -3326,9 +3326,11 @@ static struct ctl_table ipv4_route_table[] = { 
	{ }

};



static const char ipv4_route_flush_procname[] = "flush";



static struct ctl_table ipv4_route_flush_table[] = {

	{

		.procname	= "flush",

		.procname	= ipv4_route_flush_procname,

		.maxlen		= sizeof(int),

		.mode		= 0200,

		.proc_handler	= ipv4_sysctl_rtcache_flush,
@@ -3346,10 +3348,12 @@ static __net_init int sysctl_route_net_init(struct net *net) 
		if (!tbl)

			goto err_dup;



		/* Don't export sysctls to unprivileged users */

		if (net->user_ns != &init_user_ns)

		/* Don't export non-whitelisted sysctls to unprivileged users */

		if (net->user_ns != &init_user_ns) {

			if (tbl[0].procname != ipv4_route_flush_procname)

				tbl[0].procname = NULL;

		}

	}

	tbl[0].extra1 = net;



	net->ipv4.route_hdr = register_net_sysctl(net, "net/ipv4/route", tbl);