Re: [PATCH net-next] ipvs: allow some sysctls in non-init user namespaces

2024-04-18 Thread Aleksandr Mikhalitsyn
On Wed, Apr 17, 2024 at 3:02 PM Julian Anastasov wrote: > > > Hello, Dear Julian, > > On Tue, 16 Apr 2024, Alexander Mikhalitsyn wrote: > > > Let's make all IPVS sysctls visible and RO even when > > network namespace is owned by non-initial user namespace. > > > > Let's make a few sysctl

Re: [PATCH net-next] ipvs: allow some sysctls in non-init user namespaces

2024-04-17 Thread Julian Anastasov
Hello, On Tue, 16 Apr 2024, Alexander Mikhalitsyn wrote: > Let's make all IPVS sysctls visible and RO even when > network namespace is owned by non-initial user namespace. > > Let's make a few sysctls to be writable: > - conntrack > - conn_reuse_mode > - expire_nodest_conn > - expire_qu

[PATCH net-next] ipvs: allow some sysctls in non-init user namespaces

2024-04-16 Thread Alexander Mikhalitsyn
Let's make all IPVS sysctls visible and RO even when network namespace is owned by non-initial user namespace. Let's make a few sysctls to be writable: - conntrack - conn_reuse_mode - expire_nodest_conn - expire_quiescent_template I'm trying to be conservative with this to prevent introducing any