From: David S. Miller Date: Mon, 12 Apr 2021 20:27:11 +0000 (-0700) Subject: Merge branch 'netns-sysctl-isolation' X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=645b34a7b544686d82c6a082bc78df33c322cae9;p=linux.git Merge branch 'netns-sysctl-isolation' Jonathon Reinhart says: ==================== Ensuring net sysctl isolation This patchset is the result of an audit of /proc/sys/net to prove that it is safe to be mouted read-write in a container when a net namespace is in use. See [1]. The first commit adds code to detect sysctls which are not netns-safe, and can "leak" changes to other net namespaces. My manual audit found, and the above feature confirmed, that there are two nf_conntrack sysctls which are in fact not netns-safe. I considered sending the latter to netfilter-devel, but I think it's better to have both together on net-next: Adding only the former causes undesirable warnings in the kernel log. [1]: https://github.com/opencontainers/runc/issues/2826 ==================== Signed-off-by: David S. Miller --- 645b34a7b544686d82c6a082bc78df33c322cae9