diff options
author | Pavel Emelyanov <xemul@openvz.org> | 2007-12-08 00:09:24 -0800 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2008-01-28 14:56:56 -0800 |
commit | 024626e36d75fc8c6e32d50d4c68bfc3b8df5fdf (patch) | |
tree | ada6c8c215a5c4fa57e9e34f3b139609b95b2c5f /net | |
parent | cbbb90e68cd073b8d63b491166066e347902b7e9 (diff) | |
download | linux-3.10-024626e36d75fc8c6e32d50d4c68bfc3b8df5fdf.tar.gz linux-3.10-024626e36d75fc8c6e32d50d4c68bfc3b8df5fdf.tar.bz2 linux-3.10-024626e36d75fc8c6e32d50d4c68bfc3b8df5fdf.zip |
[NET] sysctl: make the sys.net.core sysctls per-namespace
Making them per-namespace is required for the following
two reasons:
First, some ctl values have a per-namespace meaning.
Second, making them writable from the sub-namespace
is an isolation hole.
So I introduce the pernet operations to create these
tables. For init_net I use the existing statically
declared tables, for sub-namespace they are duplicated
and the write bits are removed from the mode.
Signed-off-by: Pavel Emelyanov <xemul@openvz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
-rw-r--r-- | net/core/sysctl_net_core.c | 50 |
1 files changed, 45 insertions, 5 deletions
diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c index e322713e590..57a7eadb855 100644 --- a/net/core/sysctl_net_core.c +++ b/net/core/sysctl_net_core.c @@ -151,18 +151,58 @@ static struct ctl_table net_core_table[] = { { .ctl_name = 0 } }; -static __initdata struct ctl_path net_core_path[] = { +static __net_initdata struct ctl_path net_core_path[] = { { .procname = "net", .ctl_name = CTL_NET, }, { .procname = "core", .ctl_name = NET_CORE, }, { }, }; -static __init int sysctl_core_init(void) +static __net_init int sysctl_core_net_init(struct net *net) { - struct ctl_table_header *hdr; + struct ctl_table *tbl, *tmp; + + tbl = net_core_table; + if (net != &init_net) { + tbl = kmemdup(tbl, sizeof(net_core_table), GFP_KERNEL); + if (tbl == NULL) + goto err_dup; + + for (tmp = tbl; tmp->procname; tmp++) + tmp->mode &= ~0222; + } + + net->sysctl_core_hdr = register_net_sysctl_table(net, + net_core_path, tbl); + if (net->sysctl_core_hdr == NULL) + goto err_reg; - hdr = register_sysctl_paths(net_core_path, net_core_table); - return hdr == NULL ? -ENOMEM : 0; + return 0; + +err_reg: + if (tbl != net_core_table) + kfree(tbl); +err_dup: + return -ENOMEM; +} + +static __net_exit void sysctl_core_net_exit(struct net *net) +{ + struct ctl_table *tbl; + + tbl = net->sysctl_core_hdr->ctl_table_arg; + unregister_net_sysctl_table(net->sysctl_core_hdr); + BUG_ON(tbl == net_core_table); + kfree(tbl); +} + +static __net_initdata struct pernet_operations sysctl_core_ops = { + .init = sysctl_core_net_init, + .exit = sysctl_core_net_exit, +}; + +static __init int sysctl_core_init(void) +{ + return register_pernet_subsys(&sysctl_core_ops); } __initcall(sysctl_core_init); |