lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

[NET] sysctl: make the sys.net.core sysctls per-namespace

Browse Source 
Making them per-namespace is required for the following
two reasons:

 First, some ctl values have a per-namespace meaning.
 Second, making them writable from the sub-namespace
 is an isolation hole.

So I introduce the pernet operations to create these
tables. For init_net I use the existing statically
declared tables, for sub-namespace they are duplicated
and the write bits are removed from the mode.

Signed-off-by: Pavel Emelyanov <xemul@openvz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Pavel Emelyanov
2007-12-08 00:09:24 -08:00
committed by David S. Miller
parent cbbb90e68c
commit 024626e36d
2 changed files with 48 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
include/net/net_namespace.h
View File

@@ -37,6 +37,9 @@ struct net {
struct sock *rtnl; /* rtnetlink socket */ struct sock *rtnl; /* rtnetlink socket */
/* core sysctls */
struct ctl_table_header *sysctl_core_hdr;
/* List of all packet sockets. */ /* List of all packet sockets. */
rwlock_t packet_sklist_lock; rwlock_t packet_sklist_lock;
struct hlist_head packet_sklist; struct hlist_head packet_sklist;

50
net/core/sysctl_net_core.c
View File

@@ -151,18 +151,58 @@ static struct ctl_table net_core_table[] = {
{ .ctl_name = 0 } { .ctl_name = 0 }
}; };
static __initdata struct ctl_path net_core_path[] = { static __net_initdata struct ctl_path net_core_path[] = {
{ .procname = "net", .ctl_name = CTL_NET, }, { .procname = "net", .ctl_name = CTL_NET, },
{ .procname = "core", .ctl_name = NET_CORE, }, { .procname = "core", .ctl_name = NET_CORE, },
{ }, { },
}; };
static __net_init int sysctl_core_net_init(struct net *net)
{
struct ctl_table *tbl, *tmp;
tbl = net_core_table;
if (net != &init_net) {
tbl = kmemdup(tbl, sizeof(net_core_table), GFP_KERNEL);
if (tbl == NULL)
goto err_dup;
for (tmp = tbl; tmp->procname; tmp++)
tmp->mode &= ~0222;
}
net->sysctl_core_hdr = register_net_sysctl_table(net,
net_core_path, tbl);
if (net->sysctl_core_hdr == NULL)
goto err_reg;
return 0;
err_reg:
if (tbl != net_core_table)
kfree(tbl);
err_dup:
return -ENOMEM;
}
static __net_exit void sysctl_core_net_exit(struct net *net)
{
struct ctl_table *tbl;
tbl = net->sysctl_core_hdr->ctl_table_arg;
unregister_net_sysctl_table(net->sysctl_core_hdr);
BUG_ON(tbl == net_core_table);
kfree(tbl);
}
static __net_initdata struct pernet_operations sysctl_core_ops = {
.init = sysctl_core_net_init,
.exit = sysctl_core_net_exit,
};
static __init int sysctl_core_init(void) static __init int sysctl_core_init(void)
{ {
struct ctl_table_header *hdr; return register_pernet_subsys(&sysctl_core_ops);
hdr = register_sysctl_paths(net_core_path, net_core_table);
return hdr == NULL ? -ENOMEM : 0;
} }
__initcall(sysctl_core_init); __initcall(sysctl_core_init);