Re: [PATCH net-next] net: Enable some sysctls for the userns root with privilege

On Mon, Dec 06, 2021 at 04:45:20PM -0800, Jakub Kicinski wrote:

On Fri,  3 Dec 2021 03:28:15 +0000 cgel.zte@gmail.com wrote:

quoted

From: xu xin <redacted>

Enabled sysctls include the followings: 
1. net/ipv4/neigh/<if>/* 
2. net/ipv6/neigh/<if>/* 
3. net/ieee802154/6lowpan/* 
4. net/ipv6/route/* 
5. net/ipv4/vs/* 
6. net/unix/* 
7. net/core/xfrm_*

In practical work, some userns with root privilege have needs to adjust
these sysctls in their own netns, but limited just because they are not
init user_ns, even if they are given root privilege by docker -privilege.

You need to justify why removing these checks is safe. It sounds like
you're only describing why having the permissions is problematic, which 
is fair but not sufficient to just remove them.

Hi, Jakub
My patch is a little radical. I just saw Eric's previous reply to
Alexander(https://lore.kernel.org/all/87pmsqyuqy.fsf@disp2133/ (local)).
These were disabled because out of an abundance of caution.

My original intention is to enable part of syscyls about neighbor which
I think was safe, but I will try to figure out which of these sysctls
are safe to be enabled.

quoted

Reported-by: xu xin <redacted>
Tested-by: xu xin <redacted>

These tags are superfluous for the author of the patch.

Ok. thank you to correct me.

quoted

Signed-off-by: xu xin <redacted>
---
 net/core/neighbour.c                | 4 ----
 net/ieee802154/6lowpan/reassembly.c | 4 ----
 net/ipv6/route.c                    | 4 ----
 net/netfilter/ipvs/ip_vs_ctl.c      | 4 ----
 net/netfilter/ipvs/ip_vs_lblc.c     | 4 ----
 net/netfilter/ipvs/ip_vs_lblcr.c    | 3 ---
 net/unix/sysctl_net_unix.c          | 4 ----
 net/xfrm/xfrm_sysctl.c              | 4 ----
 8 files changed, 31 deletions(-)