ipvs: allow some sysctls in non-init user namespaces

Let's make all IPVS sysctls writtable even when
network namespace is owned by non-initial user namespace.

Let's make a few sysctls to be read-only for non-privileged users:
- sync_qlen_max
- sync_sock_size
- run_estimation
- est_cpulist
- est_nice

I'm trying to be conservative with this to prevent
introducing any security issues in there. Maybe,
we can allow more sysctls to be writable, but let's
do this on-demand and when we see real use-case.

This patch is motivated by user request in the LXC
project [1]. Having this can help with running some
Kubernetes [2] or Docker Swarm [3] workloads inside the system
containers.

Link: https://github.com/lxc/lxc/issues/4278
Link: https://github.com/kubernetes/kubernetes/blob/b722d017a34b300a2284b890448e5a605f21d01e/pkg/proxy/ipvs/proxier.go#L103
Link: https://github.com/moby/libnetwork/blob/3797618f9a38372e8107d8c06f6ae199e1133ae8/osl/namespace_linux.go#L682
Cc: Julian Anastasov <ja@ssi.bg>
Cc: Simon Horman <horms@verge.net.au>
Cc: Pablo Neira Ayuso <pablo@netfilter.org>
Cc: Jozsef Kadlecsik <kadlec@netfilter.org>
Cc: Florian Westphal <fw@strlen.de>
Signed-off-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@canonical.com>
Acked-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index e122fa367b8173ee5e0f8688fcbed96cf1fb439e..b6d0dcf3a5c3458c0967f97e6ccffeca971aa066 100644 (file)
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -4269,6 +4269,7 @@ static int __net_init ip_vs_control_net_init_sysctl(struct netns_ipvs *ipvs)
        struct ctl_table *tbl;
        int idx, ret;
        size_t ctl_table_size = ARRAY_SIZE(vs_vars);
+       bool unpriv = net->user_ns != &init_user_ns;
 
        atomic_set(&ipvs->dropentry, 0);
        spin_lock_init(&ipvs->dropentry_lock);
@@ -4283,10 +4284,6 @@ static int __net_init ip_vs_control_net_init_sysctl(struct netns_ipvs *ipvs)
                tbl = kmemdup(vs_vars, sizeof(vs_vars), GFP_KERNEL);
                if (tbl == NULL)
                        return -ENOMEM;
-
-               /* Don't export sysctls to unprivileged users */
-               if (net->user_ns != &init_user_ns)
-                       ctl_table_size = 0;
        } else
                tbl = vs_vars;
        /* Initialize sysctl defaults */
@@ -4312,10 +4309,17 @@ static int __net_init ip_vs_control_net_init_sysctl(struct netns_ipvs *ipvs)
        ipvs->sysctl_sync_ports = 1;
        tbl[idx++].data = &ipvs->sysctl_sync_ports;
        tbl[idx++].data = &ipvs->sysctl_sync_persist_mode;
+
        ipvs->sysctl_sync_qlen_max = nr_free_buffer_pages() / 32;
+       if (unpriv)
+               tbl[idx].mode = 0444;
        tbl[idx++].data = &ipvs->sysctl_sync_qlen_max;
+
        ipvs->sysctl_sync_sock_size = 0;
+       if (unpriv)
+               tbl[idx].mode = 0444;
        tbl[idx++].data = &ipvs->sysctl_sync_sock_size;
+
        tbl[idx++].data = &ipvs->sysctl_cache_bypass;
        tbl[idx++].data = &ipvs->sysctl_expire_nodest_conn;
        tbl[idx++].data = &ipvs->sysctl_sloppy_tcp;
@@ -4338,15 +4342,22 @@ static int __net_init ip_vs_control_net_init_sysctl(struct netns_ipvs *ipvs)
        tbl[idx++].data = &ipvs->sysctl_conn_reuse_mode;
        tbl[idx++].data = &ipvs->sysctl_schedule_icmp;
        tbl[idx++].data = &ipvs->sysctl_ignore_tunneled;
+
        ipvs->sysctl_run_estimation = 1;
+       if (unpriv)
+               tbl[idx].mode = 0444;
        tbl[idx].extra2 = ipvs;
        tbl[idx++].data = &ipvs->sysctl_run_estimation;
 
        ipvs->est_cpulist_valid = 0;
+       if (unpriv)
+               tbl[idx].mode = 0444;
        tbl[idx].extra2 = ipvs;
        tbl[idx++].data = &ipvs->sysctl_est_cpulist;
 
        ipvs->sysctl_est_nice = IPVS_EST_NICE;
+       if (unpriv)
+               tbl[idx].mode = 0444;
        tbl[idx].extra2 = ipvs;
        tbl[idx++].data = &ipvs->sysctl_est_nice;