This patchset is the result of an audit of /proc/sys/net to prove that it is safe to be mouted read-write in a container when a net namespace is in use. See [1].
The first commit adds code to detect sysctls which are not netns-safe, and can "leak" changes to other net namespaces. My manual audit found, and the above feature confirmed, that there are two nf_conntrack sysctls which are in fact not netns-safe. I considered sending the latter to netfilter-devel, but I think it's better to have both together on net-next: Adding only the former causes undesirable warnings in the kernel log. [1]: https://github.com/opencontainers/runc/issues/2826 Jonathon Reinhart (2): net: Ensure net namespace isolation of sysctls netfilter: conntrack: Make global sysctls readonly in non-init netns net/netfilter/nf_conntrack_standalone.c | 10 ++---- net/sysctl_net.c | 48 +++++++++++++++++++++++++ 2 files changed, 50 insertions(+), 8 deletions(-) -- 2.20.1
