netdev - Re: [PATCH] ipv6: enable net.ipv6.route sysctls in network namespace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20210921060909.380179f0@kicinski-fedora-pc1c0hjn.dhcp.thefacebook.com>
Date:   Tue, 21 Sep 2021 06:09:09 -0700
From:   Jakub Kicinski <kuba@...nel.org>
To:     Alexander Kuznetsov <wwfq@...dex-team.ru>
Cc:     netdev@...r.kernel.org, zeil@...dex-team.ru
Subject: Re: [PATCH] ipv6: enable net.ipv6.route sysctls in network
 namespace

On Tue, 21 Sep 2021 09:22:04 +0300 Alexander Kuznetsov wrote:
> We want to increase route cache size in network namespace
> created with user namespace. Currently ipv6 route settings
> are disabled for non-initial network namespaces.
> Since routes are per network namespace it is safe
> to enable these sysctls.
> 
> Signed-off-by: Alexander Kuznetsov <wwfq@...dex-team.ru>
> Acked-by: Dmitry Yakunin <zeil@...dex-team.ru>

Your CC list is very narrow. IMO you should CC Eric B on this, 
at the very least.

Why only remove this part and not any other part of 464dc801c76aa?

> diff --git a/net/ipv6/route.c b/net/ipv6/route.c
> index b6ddf23..de85e3b 100644
> --- a/net/ipv6/route.c
> +++ b/net/ipv6/route.c
> @@ -6415,10 +6415,6 @@ struct ctl_table * __net_init ipv6_route_sysctl_init(struct net *net)
>  		table[8].data = &net->ipv6.sysctl.ip6_rt_min_advmss;
>  		table[9].data = &net->ipv6.sysctl.ip6_rt_gc_min_interval;
>  		table[10].data = &net->ipv6.sysctl.skip_notify_on_dev_down;
> -
> -		/* Don't export sysctls to unprivileged users */
> -		if (net->user_ns != &init_user_ns)
> -			table[0].procname = NULL;
>  	}
>  
>  	return table;

I don't know much about user ns, are we making an assumption here that
this user ns corresponds to a net ns? Or just because it's _possible_
to make them 1:1 we can shift the decision to the admin?