On Thu, Jan 12, 2017 at 06:39:57AM -0800, Eric Dumazet wrote:

On Wed, 2017-01-11 at 22:52 -0800, Krister Johansen wrote:

quoted

Add net.ipv4.ip_unprotected_port_start, which is a per namespace sysctl
that denotes the first unprotected inet port in the namespace.  To
disable all protected ports set this to zero.  It also checks for
overlap with the local port range.  The protected and local range may
not overlap.

The use case for this change is to allow containerized processes to bind
to priviliged ports, but prevent them from ever being allowed to modify
their container's network configuration.  The latter is accomplished by
ensuring that the network namespace is not a child of the user
namespace.  This modification was needed to allow the container manager
to disable a namespace's priviliged port restrictions without exposing
control of the network namespace to processes in the user namespace.

Signed-off-by: Krister Johansen <redacted>
---
 include/net/ip.h               | 10 +++++++++
 include/net/netns/ipv4.h       |  1 +
 net/ipv4/af_inet.c             |  5 ++++-
 net/ipv4/sysctl_net_ipv4.c     | 50 +++++++++++++++++++++++++++++++++++++++++-
 net/ipv6/af_inet6.c            |  3 ++-
 net/netfilter/ipvs/ip_vs_ctl.c |  7 +++---
 net/sctp/socket.c              | 10 +++++----
 security/selinux/hooks.c       |  3 ++-

Adding a new sysctl without documentation is generally not accepted.

Please take a look at Documentation/networking/ip-sysctl.txt

Thanks for catching this.  I'll add an entry to the documentation.

BTW, sticking to 'unprivileged' ports might be better than 'unprotected'
which is vague.

I don't have a strong preference about the naming.  I'd be happy to
change it to 'unprivileged' instead.

-K