netns: Introduce sysctl root for read-only net sysctls.
This one stores all ctl-heads in one list and restricts the permissions not give write access to non-init net namespaces. Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
5b06c85c3b
commit
d62c612ef8
2 changed files with 33 additions and 0 deletions
|
@ -201,8 +201,11 @@ extern void unregister_pernet_gen_device(int id, struct pernet_operations *);
|
|||
struct ctl_path;
|
||||
struct ctl_table;
|
||||
struct ctl_table_header;
|
||||
|
||||
extern struct ctl_table_header *register_net_sysctl_table(struct net *net,
|
||||
const struct ctl_path *path, struct ctl_table *table);
|
||||
extern struct ctl_table_header *register_net_sysctl_rotable(
|
||||
const struct ctl_path *path, struct ctl_table *table);
|
||||
extern void unregister_net_sysctl_table(struct ctl_table_header *header);
|
||||
|
||||
#endif /* __NET_NET_NAMESPACE_H */
|
||||
|
|
|
@ -40,6 +40,27 @@ static struct ctl_table_root net_sysctl_root = {
|
|||
.lookup = net_ctl_header_lookup,
|
||||
};
|
||||
|
||||
static LIST_HEAD(net_sysctl_ro_tables);
|
||||
static struct list_head *net_ctl_ro_header_lookup(struct ctl_table_root *root,
|
||||
struct nsproxy *namespaces)
|
||||
{
|
||||
return &net_sysctl_ro_tables;
|
||||
}
|
||||
|
||||
static int net_ctl_ro_header_perms(struct ctl_table_root *root,
|
||||
struct nsproxy *namespaces, struct ctl_table *table)
|
||||
{
|
||||
if (namespaces->net_ns == &init_net)
|
||||
return table->mode;
|
||||
else
|
||||
return table->mode & ~0222;
|
||||
}
|
||||
|
||||
static struct ctl_table_root net_sysctl_ro_root = {
|
||||
.lookup = net_ctl_ro_header_lookup,
|
||||
.permissions = net_ctl_ro_header_perms,
|
||||
};
|
||||
|
||||
static int sysctl_net_init(struct net *net)
|
||||
{
|
||||
INIT_LIST_HEAD(&net->sysctl_table_headers);
|
||||
|
@ -64,6 +85,7 @@ static __init int sysctl_init(void)
|
|||
if (ret)
|
||||
goto out;
|
||||
register_sysctl_root(&net_sysctl_root);
|
||||
register_sysctl_root(&net_sysctl_ro_root);
|
||||
out:
|
||||
return ret;
|
||||
}
|
||||
|
@ -80,6 +102,14 @@ struct ctl_table_header *register_net_sysctl_table(struct net *net,
|
|||
}
|
||||
EXPORT_SYMBOL_GPL(register_net_sysctl_table);
|
||||
|
||||
struct ctl_table_header *register_net_sysctl_rotable(const
|
||||
struct ctl_path *path, struct ctl_table *table)
|
||||
{
|
||||
return __register_sysctl_paths(&net_sysctl_ro_root,
|
||||
&init_nsproxy, path, table);
|
||||
}
|
||||
EXPORT_SYMBOL_GPL(register_net_sysctl_rotable);
|
||||
|
||||
void unregister_net_sysctl_table(struct ctl_table_header *header)
|
||||
{
|
||||
unregister_sysctl_table(header);
|
||||
|
|
Loading…
Reference in a new issue