summaryrefslogtreecommitdiff
path: root/net
diff options
context:
space:
mode:
authorPavel Emelyanov <xemul@openvz.org>2007-12-08 00:09:24 -0800
committerDavid S. Miller <davem@davemloft.net>2008-01-28 14:56:56 -0800
commit024626e36d75fc8c6e32d50d4c68bfc3b8df5fdf (patch)
treeada6c8c215a5c4fa57e9e34f3b139609b95b2c5f /net
parentcbbb90e68cd073b8d63b491166066e347902b7e9 (diff)
[NET] sysctl: make the sys.net.core sysctls per-namespace
Making them per-namespace is required for the following two reasons: First, some ctl values have a per-namespace meaning. Second, making them writable from the sub-namespace is an isolation hole. So I introduce the pernet operations to create these tables. For init_net I use the existing statically declared tables, for sub-namespace they are duplicated and the write bits are removed from the mode. Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
-rw-r--r--net/core/sysctl_net_core.c50
1 files changed, 45 insertions, 5 deletions
diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
index e322713e590a..57a7eadb8551 100644
--- a/net/core/sysctl_net_core.c
+++ b/net/core/sysctl_net_core.c
@@ -151,18 +151,58 @@ static struct ctl_table net_core_table[] = {
{ .ctl_name = 0 }
};
-static __initdata struct ctl_path net_core_path[] = {
+static __net_initdata struct ctl_path net_core_path[] = {
{ .procname = "net", .ctl_name = CTL_NET, },
{ .procname = "core", .ctl_name = NET_CORE, },
{ },
};
-static __init int sysctl_core_init(void)
+static __net_init int sysctl_core_net_init(struct net *net)
{
- struct ctl_table_header *hdr;
+ struct ctl_table *tbl, *tmp;
+
+ tbl = net_core_table;
+ if (net != &init_net) {
+ tbl = kmemdup(tbl, sizeof(net_core_table), GFP_KERNEL);
+ if (tbl == NULL)
+ goto err_dup;
+
+ for (tmp = tbl; tmp->procname; tmp++)
+ tmp->mode &= ~0222;
+ }
+
+ net->sysctl_core_hdr = register_net_sysctl_table(net,
+ net_core_path, tbl);
+ if (net->sysctl_core_hdr == NULL)
+ goto err_reg;
- hdr = register_sysctl_paths(net_core_path, net_core_table);
- return hdr == NULL ? -ENOMEM : 0;
+ return 0;
+
+err_reg:
+ if (tbl != net_core_table)
+ kfree(tbl);
+err_dup:
+ return -ENOMEM;
+}
+
+static __net_exit void sysctl_core_net_exit(struct net *net)
+{
+ struct ctl_table *tbl;
+
+ tbl = net->sysctl_core_hdr->ctl_table_arg;
+ unregister_net_sysctl_table(net->sysctl_core_hdr);
+ BUG_ON(tbl == net_core_table);
+ kfree(tbl);
+}
+
+static __net_initdata struct pernet_operations sysctl_core_ops = {
+ .init = sysctl_core_net_init,
+ .exit = sysctl_core_net_exit,
+};
+
+static __init int sysctl_core_init(void)
+{
+ return register_pernet_subsys(&sysctl_core_ops);
}
__initcall(sysctl_core_init);