Re: [PATCH net-2.6.25 1/3]sysctl: make the sys.net.core sysctls per-namespace

[David Miller]

From: Pavel Emelyanov [EMAIL PROTECTED]
Date: Fri, 07 Dec 2007 16:07:19 +0300

 Making them per-namespace is required for the following 
 two reasons:
 
  First, some ctl values have a per-namespace meaning.
  Second, making them writable from the sub-namespace
  is an isolation hole.
 
 So I introduce the pernet operations to create these
 tables. For init_net I use the existing statically
 declared tables, for sub-namespace they are duplicated
 and the write bits are removed from the mode.
 
 Signed-off-by: Pavel Emelyanov [EMAIL PROTECTED]

Applied to net-2.6.25, but I fear you're going to need to do something
similar for ipv4, ipv6, and who knows what other protocols.  And as a
result we'll end up with all kinds of protocol specific things in the
net namespace structure which totally stinks.

Such things will need to be registered dynamically just like the
protocols themselves are into the kernel.
--
To unsubscribe from this list: send the line unsubscribe netdev in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[PATCH net-2.6.25 1/3]sysctl: make the sys.net.core sysctls per-namespace

[Pavel Emelyanov]

Making them per-namespace is required for the following 
two reasons:

 First, some ctl values have a per-namespace meaning.
 Second, making them writable from the sub-namespace
 is an isolation hole.

So I introduce the pernet operations to create these
tables. For init_net I use the existing statically
declared tables, for sub-namespace they are duplicated
and the write bits are removed from the mode.

Signed-off-by: Pavel Emelyanov [EMAIL PROTECTED]

---

diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
index f97b2a4..d593611 100644
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -37,6 +37,9 @@ struct net {
 
struct sock *rtnl;  /* rtnetlink socket */
 
+   /* core sysctls */
+   struct ctl_table_header *sysctl_core_hdr;
+
/* List of all packet sockets. */
rwlock_tpacket_sklist_lock;
struct hlist_head   packet_sklist;
diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
index e322713..57a7ead 100644
--- a/net/core/sysctl_net_core.c
+++ b/net/core/sysctl_net_core.c
@@ -151,18 +151,58 @@ static struct ctl_table net_core_table[] = {
{ .ctl_name = 0 }
 };
 
-static __initdata struct ctl_path net_core_path[] = {
+static __net_initdata struct ctl_path net_core_path[] = {
{ .procname = net, .ctl_name = CTL_NET, },
{ .procname = core, .ctl_name = NET_CORE, },
{ },
 };
 
-static __init int sysctl_core_init(void)
+static __net_init int sysctl_core_net_init(struct net *net)
 {
-   struct ctl_table_header *hdr;
+   struct ctl_table *tbl, *tmp;
+
+   tbl = net_core_table;
+   if (net != init_net) {
+   tbl = kmemdup(tbl, sizeof(net_core_table), GFP_KERNEL);
+   if (tbl == NULL)
+   goto err_dup;
+
+   for (tmp = tbl; tmp-procname; tmp++)
+   tmp-mode = ~0222;
+   }
+
+   net-sysctl_core_hdr = register_net_sysctl_table(net,
+   net_core_path, tbl);
+   if (net-sysctl_core_hdr == NULL)
+   goto err_reg;
 
-   hdr = register_sysctl_paths(net_core_path, net_core_table);
-   return hdr == NULL ? -ENOMEM : 0;
+   return 0;
+
+err_reg:
+   if (tbl != net_core_table)
+   kfree(tbl);
+err_dup:
+   return -ENOMEM;
+}
+
+static __net_exit void sysctl_core_net_exit(struct net *net)
+{
+   struct ctl_table *tbl;
+
+   tbl = net-sysctl_core_hdr-ctl_table_arg;
+   unregister_net_sysctl_table(net-sysctl_core_hdr);
+   BUG_ON(tbl == net_core_table);
+   kfree(tbl);
+}
+
+static __net_initdata struct pernet_operations sysctl_core_ops = {
+   .init = sysctl_core_net_init,
+   .exit = sysctl_core_net_exit,
+};
+
+static __init int sysctl_core_init(void)
+{
+   return register_pernet_subsys(sysctl_core_ops);
 }
 
 __initcall(sysctl_core_init);
-- 
1.5.3.4


--
To unsubscribe from this list: send the line unsubscribe netdev in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html