netdev - Re: [PATCH] netfilter: conntrack: Make global sysctls readonly in non-init netns

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 17 May 2021 14:03:55 +0200
From:   Greg KH <gregkh@...uxfoundation.org>
To:     Jonathon Reinhart <jonathon.reinhart@...il.com>
Cc:     stable@...r.kernel.org, "David S. Miller" <davem@...emloft.net>,
        Florian Westphal <fw@...len.de>, netdev@...r.kernel.org
Subject: Re: [PATCH] netfilter: conntrack: Make global sysctls readonly in
 non-init netns

On Thu, May 13, 2021 at 04:28:35AM -0400, Jonathon Reinhart wrote:
> commit 2671fa4dc0109d3fb581bc3078fdf17b5d9080f6 upstream.
> 
> These sysctls point to global variables:
> - [0] "nf_conntrack_max"        (&nf_conntrack_max)
> - [2] "nf_conntrack_buckets"    (&nf_conntrack_htable_size_user)
> - [5] "nf_conntrack_expect_max" (&nf_ct_expect_max)
> 
> Because their data pointers are not updated to point to per-netns
> structures, they must be marked read-only in a non-init_net ns.
> Otherwise, changes in any net namespace are reflected in (leaked into)
> all other net namespaces. This problem has existed since the
> introduction of net namespaces.
> 
> This patch is necessarily different from the upstream patch due to the
> heavy refactoring which took place since 4.19:
> 
> d0febd81ae77 ("netfilter: conntrack: re-visit sysctls in unprivileged namespaces")
> b884fa461776 ("netfilter: conntrack: unify sysctl handling")
> 4a65798a9408 ("netfilter: conntrack: add mnemonics for sysctl table")
> 
> Signed-off-by: Jonathon Reinhart <jonathon.reinhart@...il.com>
> ---
> 
> Upstream commit 2671fa4dc010 was already applied to the 5.10, 5.11, and
> 5.12 trees.
> 
> This was tested on 4.19.190, so please apply to 4.19.y.
> 
> It should also apply to:
> - 4.14.y
> - 4.9.y
> 
> Note that 5.4.y would require a slightly different patch that looks more
> like 2671fa4dc010.

All now queued up, thanks!

greg k-h