[Devel] [PATCH RHEL7 COMMIT] net: export net/core/somaxconn sysctl for unprivileged users

[Konstantin Khorenko]

The commit is pushed to "branch-rh7-3.10.0-957.1.3.vz7.83.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-957.1.3.vz7.83.10
------>
commit dccf5143b132857e966e60f19fad2a1176dcd0eb
Author: Jan Dakinevich <jan.dakinevich at virtuozzo.com>
Date:   Fri Jan 25 17:37:55 2019 +0300

    net: export net/core/somaxconn sysctl for unprivileged users
    
    Some unprivileged containers desire this sysctl. Apparently it is safe
    for userns root, and there is no reason to restrict them.
    
    https://jira.sw.ru/browse/PSBM-91032
    
    Signed-off-by: Jan Dakinevich <jan.dakinevich at virtuozzo.com>
    Reviewed-by: Vasily Averin <vvs at virtuozzo.com>
---
 net/core/sysctl_net_core.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
index 449e413a4093..c4a9215a0a6c 100644
--- a/net/core/sysctl_net_core.c
+++ b/net/core/sysctl_net_core.c
@@ -341,9 +341,8 @@ static __net_init int sysctl_core_net_init(struct net *net)
 		tbl[0].data = &net->core.sysctl_somaxconn;
 
 		/* Don't export any sysctls to unprivileged users */
-		if (net->user_ns != &init_user_ns) {
+		if (ve_net_hide_sysctl(net))
 			tbl[0].procname = NULL;
-		}
 	}
 
 	net->core.sysctl_hdr = register_net_sysctl(net, "net/core", tbl);