| From e106f34ca9de6cbb1335be128abd88e0b0544caa Mon Sep 17 00:00:00 2001 |
| From: Kevin Cernekee <cernekee@chromium.org> |
| Date: Thu, 30 Jun 2016 20:49:37 -0700 |
| Subject: [PATCH] CHROMIUM: Export /proc/sys/net/core/android_paranoid in user |
| namespaces |
| |
| This knob requires special treatment because we depend on it being |
| available inside the container. When user namespaces were enabled, |
| the other knob (somaxconn) vanished. |
| |
| BUG=b:27932716 |
| TEST=`android-sh -c "ls /proc/sys/net/core"` |
| |
| Signed-off-by: Kevin Cernekee <cernekee@chromium.org> |
| Reviewed-on: https://chromium-review.googlesource.com/362672 |
| Reviewed-by: Guenter Roeck <groeck@google.com> |
| |
| (cherry picked from commit 42721a768f86a1cf7d318b59fa03ba69fa10fb3b) |
| |
| Change-Id: I22c29fc29ad774c2a70ce9f9148141974dab39e7 |
| Signed-off-by: Taoyu Li <taoyl@google.com> |
| Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/2213510 |
| Tested-by: Taoyu Li <taoyl@chromium.org> |
| Reviewed-by: Guenter Roeck <groeck@chromium.org> |
| Commit-Queue: Taoyu Li <taoyl@chromium.org> |
| Auto-Submit: Taoyu Li <taoyl@chromium.org> |
| --- |
| net/core/sysctl_net_core.c | 17 ++++++++++------- |
| 1 file changed, 10 insertions(+), 7 deletions(-) |
| |
| diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c |
| index 4a2e238155c4..1510eb43f704 100644 |
| --- a/net/core/sysctl_net_core.c |
| +++ b/net/core/sysctl_net_core.c |
| @@ -584,20 +584,20 @@ static struct ctl_table net_core_table[] = { |
| |
| static struct ctl_table netns_core_table[] = { |
| { |
| - .procname = "somaxconn", |
| - .data = &init_net.core.sysctl_somaxconn, |
| + .procname = "android_paranoid", |
| + .data = &init_net.core.sysctl_android_paranoid, |
| .maxlen = sizeof(int), |
| .mode = 0644, |
| .extra1 = SYSCTL_ZERO, |
| + .extra2 = SYSCTL_ONE, |
| .proc_handler = proc_dointvec_minmax |
| }, |
| { |
| - .procname = "android_paranoid", |
| - .data = &init_net.core.sysctl_android_paranoid, |
| + .procname = "somaxconn", |
| + .data = &init_net.core.sysctl_somaxconn, |
| .maxlen = sizeof(int), |
| .mode = 0644, |
| .extra1 = SYSCTL_ZERO, |
| - .extra2 = SYSCTL_ONE, |
| .proc_handler = proc_dointvec_minmax |
| }, |
| { |
| @@ -640,9 +640,12 @@ static __net_init int sysctl_core_net_init(struct net *net) |
| for (tmp = tbl; tmp->procname; tmp++) |
| tmp->data += (char *)net - (char *)&init_net; |
| |
| - /* Don't export any sysctls to unprivileged users */ |
| + /* Don't export sysctls other than android_paranoid |
| + * to unprivileged users |
| + */ |
| if (net->user_ns != &init_user_ns) { |
| - tbl[0].procname = NULL; |
| + tbl[1].procname = NULL; |
| + tbl[2].procname = NULL; |
| } |
| } |
| |
| -- |
| 2.35.0 |
| |