[Devel] [PATCH RHEL9 COMMIT] ms/netfilter: ipvs: make global sysctl readonly in non-init netns

[Konstantin Khorenko]

The commit is pushed to "branch-rh9-5.14.vz9.1.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh9-5.14.0-4.vz9.10.37
------>
commit 0098adc560a610a9e56553edae192fd6450dd6f5
Author: Antoine Tenart <atenart at kernel.org>
Date:   Mon Dec 27 18:45:02 2021 +0300

    ms/netfilter: ipvs: make global sysctl readonly in non-init netns
    
    Because the data pointer of net/ipv4/vs/debug_level is not updated per
    netns, it must be marked as read-only in non-init netns.
    
    Fixes: c6d2d445d8de ("IPVS: netns, final patch enabling network name space.")
    Signed-off-by: Antoine Tenart <atenart at kernel.org>
    Acked-by: Julian Anastasov <ja at ssi.bg>
    Signed-off-by: Pablo Neira Ayuso <pablo at netfilter.org>
    
    Upstream commit 174c376278949c44aad89c514a6b5db6cee8db59.
    
    This patch only affects builds with CONFIG_IP_VS_DEBUG.
    
    On such a build, without this patch, kernel hits a WARN() when loading
    ip_vs module, looking like
    
    [433595.586369] ------------[ cut here ]------------
    [433595.589497] sysctl net/ipv4/vs/debug_level: data points to module global data: sysctl_ip_vs_debug_level [ip_vs]
    [433595.594180] WARNING: CPU: 1 PID: 125108 at net/sysctl_net.c:156 register_net_sysctl+0x176/0x300
    [433595.598385] Modules linked in: ...
    
    This is caused by the sysctl being per-net-ns, but the value controlling
    module's debug level being global.
    
    It is better to avoid containers from altering global parameters.
    So let's make it read-only for containers.
    
    Alternative could be - per-container debug verbosity. However what
    exactly that means, and how to implement that, is not obvious. Let's
    postpone that until a real need arises.
    
    Feature: fix ms/net
    
    Signed-off-by: Nikita Yushchenko <nikita.yushchenko at virtuozzo.com>
---
 net/netfilter/ipvs/ip_vs_ctl.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 93d1c5ff5562..afbeb852d91c 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -4091,6 +4091,11 @@ static int __net_init ip_vs_control_net_init_sysctl(struct netns_ipvs *ipvs)
 	tbl[idx++].data = &ipvs->sysctl_conn_reuse_mode;
 	tbl[idx++].data = &ipvs->sysctl_schedule_icmp;
 	tbl[idx++].data = &ipvs->sysctl_ignore_tunneled;
+#ifdef CONFIG_IP_VS_DEBUG
+	/* Global sysctls must be ro in non-init netns */
+	if (!net_eq(net, &init_net))
+		tbl[idx++].mode = 0444;
+#endif
 
 	ipvs->sysctl_hdr = register_net_sysctl(net, "net/ipv4/vs", tbl);
 	if (ipvs->sysctl_hdr == NULL) {