[Devel,RHEL7,COMMIT] ve/sysctl/net: allow net.ipv4.vs.* in CT init userns

Submitted by Konstantin Khorenko on April 26, 2017, 8:19 a.m.

Details

Message ID 201704260819.v3Q8JeGN001746@finist_cl7.x64_64.work.ct
State New
Series "net/ipvs: allow IPVS in CT"
Headers show

Commit Message

Konstantin Khorenko April 26, 2017, 8:19 a.m. 
The commit is pushed to "PSBM-63883-Docker-Swarm" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-514.16.1.vz7.30.7
------>
commit f086c287d5f9cd2746a2d0d1c315f8b566dc9542
Author: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
Date:   Wed Apr 26 12:19:39 2017 +0400

    ve/sysctl/net: allow net.ipv4.vs.* in CT init userns
    
    Patchset description:
    net/ipvs: allow IPVS in CT
    
    Allowing IPVS to CT root may be unsafe, we still need to check it,
    it is about 20k lines of code. If ip_vs module is not loaded on host
    ipvs will not work in CT as all other modules depend on it. So in
    default situation this changes nothing.
    
    We need it for docker-swarm for cluster network balansing to work.
    
    https://jira.sw.ru/browse/PSBM-63883
    
    Pavel Tikhomirov (3):
      ve/sysctl/net: allow net.ipv4.vs.* in CT init userns
      netlink: allow IPVS netlink messages to CT init userns
      net/ipvs: allow IPVS modules autoload in CT
    
    =============================================
    This patch description:
    
    Swarm uses ipvs to route and balanse external traffic to cluster nodes.
    Swarm wants to enable /proc/sys/net/ipv4/vs/conntrack in CT for it's
    packets being SNATed by ipvs.
    
    https://jira.sw.ru/browse/PSBM-63883
    Signed-off-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
    Reviewed-by: Andrew Vagin <avagin@virtuozzo.com>
---
 net/netfilter/ipvs/ip_vs_ctl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Patch hide | download patch | download mbox 

diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 0d8330f..db4563d 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -3723,7 +3723,7 @@  static int __net_init ip_vs_control_net_init_sysctl(struct net *net)
 			return -ENOMEM;
 
 		/* Don't export sysctls to unprivileged users */
-		if (net->user_ns != &init_user_ns)
+		if (ve_net_hide_sysctl(net))
 			tbl[0].procname = NULL;
 	} else
 		tbl = vs_vars;