p71924506
/
linux_old1
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

ipv4: enable route flushing in network namespaces 

Tools such as vpnc try to flush routes when run inside network
namespaces by writing 1 into /proc/sys/net/ipv4/route/flush. This
currently does not work because flush is not enabled in non-initial
network namespaces.
Since routes are per network namespace it is safe to enable
/proc/sys/net/ipv4/route/flush in there.

Link: https://github.com/lxc/lxd/issues/4257
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Christian Brauner 2019-06-24 15:29:23 +02:00 committed by David S. Miller
parent 65dc5416d4
commit 5cdda5f1d6
1 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
net/ipv4/route.c
View File

@ -3326,9 +3326,11 @@ static struct ctl_table ipv4_route_table[] = {
{ }
};
static const char ipv4_route_flush_procname[] = "flush";
static struct ctl_table ipv4_route_flush_table[] = {
{
.procname = "flush",
.procname = ipv4_route_flush_procname,
.maxlen = sizeof(int),
.mode = 0200,
.proc_handler = ipv4_sysctl_rtcache_flush,
@ -3346,9 +3348,11 @@ static __net_init int sysctl_route_net_init(struct net *net)
if (!tbl)
goto err_dup;
/* Don't export sysctls to unprivileged users */
if (net->user_ns != &init_user_ns)
tbl[0].procname = NULL;
/* Don't export non-whitelisted sysctls to unprivileged users */
if (net->user_ns != &init_user_ns) {
if (tbl[0].procname != ipv4_route_flush_procname)
tbl[0].procname = NULL;
}
}
tbl[0].extra1 = net;