[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20250407101352.GA10818@breakpoint.cc>
Date: Mon, 7 Apr 2025 12:13:52 +0200
From: Florian Westphal <fw@...len.de>
To: lvxiafei <xiafei_xupt@....com>
Cc: "David S. Miller" <davem@...emloft.net>,
Eric Dumazet <edumazet@...gle.com>,
Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
Simon Horman <horms@...nel.org>,
Pablo Neira Ayuso <pablo@...filter.org>,
Jozsef Kadlecsik <kadlec@...filter.org>,
lvxiafei <lvxiafei@...setime.com>, netdev@...r.kernel.org,
linux-kernel@...r.kernel.org, netfilter-devel@...r.kernel.org,
coreteam@...filter.org
Subject: Re: [PATCH] netfilter: netns nf_conntrack: per-netns
net.netfilter.nf_conntrack_max sysctl
lvxiafei <xiafei_xupt@....com> wrote:
> The modification of nf_conntrack_max in one netns
> should not affect the value in another one.
nf_conntrack_max can only be changed in init_net.
Given the check isn't removed:
/* Don't allow non-init_net ns to alter global sysctls */
if (!net_eq(&init_net, net)) {
table[NF_SYSCTL_CT_MAX].mode = 0444;
... this patch seems untested?
But, removing this check would allow any netns to consume
arbitrary amount of kernel memory.
How do you prevent this?
Powered by blists - more mailing lists