netdev - Re: [PATCH v4] net: fully namespace net.core.{r,w}mem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAEFvpLe=wtaRGx0QyzCFgwhr+gWXHjWgcQLJrppb0EdsCFw7UQ@mail.gmail.com>
Date: Fri, 18 Apr 2025 05:34:35 -0700
From: Danny Lin <danny@...stack.dev>
To: Matteo Croce <technoboy85@...il.com>
Cc: netdev@...r.kernel.org, Matteo Croce <teknoraver@...a.com>, 
	"David S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>, 
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, Simon Horman <horms@...nel.org>, 
	David Ahern <dsahern@...nel.org>, linux-kernel@...r.kernel.org, 
	Shakeel Butt <shakeel.butt@...ux.dev>
Subject: Re: [PATCH v4] net: fully namespace net.core.{r,w}mem_{default,max} sysctls

On Fri, Apr 18, 2025 at 3:11 AM Matteo Croce <technoboy85@...il.com> wrote:
>
> Il giorno ven 18 apr 2025 alle ore 12:06 Danny Lin
> <danny@...stack.dev> ha scritto:
> >
> > This builds on commit 19249c0724f2 ("net: make net.core.{r,w}mem_{default,max} namespaced")
> > by adding support for writing the sysctls from within net namespaces,
> > rather than only reading the values that were set in init_net. These are
> > relatively commonly-used sysctls, so programs may try to set them without
> > knowing that they're in a container. It can be surprising for such attempts
> > to fail with EACCES.
> >
> > Unlike other net sysctls that were converted to namespaced ones, many
> > systems have a sysctl.conf (or other configs) that globally write to
> > net.core.rmem_default on boot and expect the value to propagate to
> > containers, and programs running in containers may depend on the increased
> > buffer sizes in order to work properly. This means that namespacing the
> > sysctls and using the kernel default values in each new netns would break
> > existing workloads.
> >
> > As a compromise, inherit the initial net.core.*mem_* values from the
> > current process' netns when creating a new netns. This is not standard
> > behavior for most netns sysctls, but it avoids breaking existing workloads.
> >
> > Signed-off-by: Danny Lin <danny@...stack.dev>
>
> Hi,
>
> does this allow to set, in a namespace, a larger buffer than the one
> in the init namespace?

Yes, the idea is that each net namespace is controlled independently.
Privileges are still required to write to the sysctl for whichever
namespace you're in, so unprivileged containers wouldn't be able to
exceed host limits.

Best,
Danny
Founder @ OrbStack

>
> Regards,
> --
> Matteo Croce
>
> perl -e 'for($t=0;;$t++){print chr($t*($t>>8|$t>>13)&255)}' |aplay