[Devel,RH7,1/2] ve/sysctl/net: move and rename *_hide_sysctl to ve.c

Submitted by Pavel Tikhomirov on March 22, 2017, 4:30 p.m.

Details

Message ID 20170322163002.16881-1-ptikhomirov@virtuozzo.com
State New
Series "Series without cover letter"
Headers show

Commit Message

Pavel Tikhomirov March 22, 2017, 4:30 p.m.
make it general for all net sysctls, will use in next patch

https://jira.sw.ru/browse/PSBM-54530

Signed-off-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
---
 include/linux/ve.h                        |  2 ++
 include/net/netfilter/nf_conntrack_core.h |  2 --
 kernel/ve/ve.c                            | 16 ++++++++++++++++
 net/netfilter/nf_conntrack_acct.c         |  2 +-
 net/netfilter/nf_conntrack_ecache.c       |  2 +-
 net/netfilter/nf_conntrack_standalone.c   | 24 ++----------------------
 6 files changed, 22 insertions(+), 26 deletions(-)

Patch hide | download patch | download mbox

diff --git a/include/linux/ve.h b/include/linux/ve.h
index 708c6d3..2d8eca6 100644
--- a/include/linux/ve.h
+++ b/include/linux/ve.h
@@ -219,6 +219,8 @@  void ve_exit_ns(struct pid_namespace *ns);
 extern bool current_user_ns_initial(void);
 struct user_namespace *ve_init_user_ns(void);
 
+int ve_net_hide_sysctl(struct net *net);
+
 #ifdef CONFIG_TTY
 #define MAX_NR_VTTY_CONSOLES	(12)
 extern struct tty_driver *vtty_driver(dev_t dev, int *index);
diff --git a/include/net/netfilter/nf_conntrack_core.h b/include/net/netfilter/nf_conntrack_core.h
index c029b52..879b7ab 100644
--- a/include/net/netfilter/nf_conntrack_core.h
+++ b/include/net/netfilter/nf_conntrack_core.h
@@ -39,8 +39,6 @@  void nf_conntrack_cleanup_start(void);
 void nf_conntrack_init_end(void);
 void nf_conntrack_cleanup_end(void);
 
-int nf_conntrack_hide_sysctl(struct net *net);
-
 bool nf_ct_get_tuple(const struct sk_buff *skb, unsigned int nhoff,
 		     unsigned int dataoff, u_int16_t l3num, u_int8_t protonum,
 		     struct nf_conntrack_tuple *tuple,
diff --git a/kernel/ve/ve.c b/kernel/ve/ve.c
index a17b048..d6bd70d 100644
--- a/kernel/ve/ve.c
+++ b/kernel/ve/ve.c
@@ -259,6 +259,22 @@  struct user_namespace *ve_init_user_ns(void)
 }
 EXPORT_SYMBOL(ve_init_user_ns);
 
+int ve_net_hide_sysctl(struct net *net)
+{
+	/*
+	 * This can happen only on VE creation, when process created VE cgroup,
+	 * and clones a child with new network namespace.
+	 */
+	if (net->owner_ve->init_cred == NULL)
+		return 0;
+
+	/*
+	 * Expose sysctl only for container's init user namespace
+	 */
+	return net->user_ns != net->owner_ve->init_cred->user_ns;
+}
+EXPORT_SYMBOL(ve_net_hide_sysctl);
+
 int nr_threads_ve(struct ve_struct *ve)
 {
 	return cgroup_task_count(ve->css.cgroup);
diff --git a/net/netfilter/nf_conntrack_acct.c b/net/netfilter/nf_conntrack_acct.c
index e35af92..363866f 100644
--- a/net/netfilter/nf_conntrack_acct.c
+++ b/net/netfilter/nf_conntrack_acct.c
@@ -71,7 +71,7 @@  static int nf_conntrack_acct_init_sysctl(struct net *net)
 	table[0].data = &net->ct.sysctl_acct;
 
 	/* Don't export sysctls to unprivileged users */
-	if (nf_conntrack_hide_sysctl(net))
+	if (ve_net_hide_sysctl(net))
 		table[0].procname = NULL;
 
 	net->ct.acct_sysctl_header = register_net_sysctl(net, "net/netfilter",
diff --git a/net/netfilter/nf_conntrack_ecache.c b/net/netfilter/nf_conntrack_ecache.c
index c605daa..a82b7f7 100644
--- a/net/netfilter/nf_conntrack_ecache.c
+++ b/net/netfilter/nf_conntrack_ecache.c
@@ -199,7 +199,7 @@  static int nf_conntrack_event_init_sysctl(struct net *net)
 	table[1].data = &net->ct.sysctl_events_retry_timeout;
 
 	/* Don't export sysctls to unprivileged users */
-	if (nf_conntrack_hide_sysctl(net))
+	if (ve_net_hide_sysctl(net))
 		table[0].procname = NULL;
 
 	net->ct.event_sysctl_header =
diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
index 7d95af8..871e6ff 100644
--- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c
@@ -505,21 +505,6 @@  static struct ctl_table nf_ct_netfilter_table[] = {
 
 static int zero;
 
-int nf_conntrack_hide_sysctl(struct net *net)
-{
-	/*
-	 * This can happen only on VE creation, when process created VE cgroup,
-	 * and clones a child with new network namespace.
-	 */
-	if (net->owner_ve->init_cred == NULL)
-		return 0;
-
-	/*
-	 * Expose sysctl only for container's init user namespace
-	 */
-	return net->user_ns != net->owner_ve->init_cred->user_ns;
-}
-
 static int nf_conntrack_netfilter_init_sysctl(struct net *net)
 {
 	struct ctl_table *table;
@@ -532,7 +517,7 @@  static int nf_conntrack_netfilter_init_sysctl(struct net *net)
 	table[0].data = &net->ct.max;
 
 	/* Don't export sysctls to unprivileged users */
-	if (nf_conntrack_hide_sysctl(net))
+	if (ve_net_hide_sysctl(net))
 		table[0].procname = NULL;
 
 	net->ct.netfilter_header = register_net_sysctl(net, "net", table);
@@ -573,7 +558,7 @@  static int nf_conntrack_standalone_init_sysctl(struct net *net)
 	table[5].data = &net->ct.expect_max;
 
 	/* Don't export sysctls to unprivileged users */
-	if (nf_conntrack_hide_sysctl(net))
+	if (ve_net_hide_sysctl(net))
 		table[0].procname = NULL;
 
 	if (!net_eq(net, &init_net)) {
@@ -603,11 +588,6 @@  static void nf_conntrack_standalone_fini_sysctl(struct net *net)
 	kfree(table);
 }
 #else
-int nf_conntrack_hide_sysctl(struct net *net)
-{
-	return 0;
-}
-
 static int nf_conntrack_netfilter_init_sysctl(struct net *net)
 {
 	return 0;

Comments

Kirill Gorkunov March 22, 2017, 7:19 p.m.
On Wed, Mar 22, 2017 at 07:30:01PM +0300, Pavel Tikhomirov wrote:
> make it general for all net sysctls, will use in next patch
> 
> https://jira.sw.ru/browse/PSBM-54530
> 
> Signed-off-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
Reviewed-by: Cyrill Gorcunov <gorcunov@openvz.org>