Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 83094f8c authored by Antoine Tenart's avatar Antoine Tenart Committed by Greg Kroah-Hartman
Browse files

netfilter: ipvs: make global sysctl readonly in non-init netns 



[ Upstream commit 174c376278949c44aad89c514a6b5db6cee8db59 ]

Because the data pointer of net/ipv4/vs/debug_level is not updated per
netns, it must be marked as read-only in non-init netns.

Fixes: c6d2d445 ("IPVS: netns, final patch enabling network name space.")
Signed-off-by: default avatarAntoine Tenart <atenart@kernel.org>
Acked-by: default avatarJulian Anastasov <ja@ssi.bg>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent ce70ee94

net/netfilter/ipvs/ip_vs_ctl.c

+5 −0
Original line number Diff line number Diff line
@@ -4047,6 +4047,11 @@ static int __net_init ip_vs_control_net_init_sysctl(struct netns_ipvs *ipvs) 
	tbl[idx++].data = &ipvs->sysctl_conn_reuse_mode;

	tbl[idx++].data = &ipvs->sysctl_schedule_icmp;

	tbl[idx++].data = &ipvs->sysctl_ignore_tunneled;

#ifdef CONFIG_IP_VS_DEBUG

	/* Global sysctls must be ro in non-init netns */

	if (!net_eq(net, &init_net))

		tbl[idx++].mode = 0444;

#endif



	ipvs->sysctl_hdr = register_net_sysctl(net, "net/ipv4/vs", tbl);

	if (ipvs->sysctl_hdr == NULL) {