netfilter: conntrack: re-visit sysctls in unprivileged namespaces

since commit b884fa46177659 ("netfilter: conntrack: unify sysctl handling")
conntrack no longer exposes most of its sysctls (e.g. tcp timeouts
settings) to network namespaces that are not owned by the initial user
namespace.

This patch exposes all sysctls even if the namespace is unpriviliged.

compared to a 4.19 kernel, the newly visible and writeable sysctls are:
  net.netfilter.nf_conntrack_acct
  net.netfilter.nf_conntrack_timestamp
  .. to allow to enable accouting and timestamp extensions.

  net.netfilter.nf_conntrack_events
  .. to turn off conntrack event notifications.

  net.netfilter.nf_conntrack_checksum
  .. to disable checksum validation.

  net.netfilter.nf_conntrack_log_invalid
  .. to enable logging of packets deemed invalid by conntrack.

newly visible sysctls that are only exported as read-only:

  net.netfilter.nf_conntrack_count
  .. current number of conntrack entries living in this netns.

  net.netfilter.nf_conntrack_max
  .. global upperlimit (maximum size of the table).

  net.netfilter.nf_conntrack_buckets
  .. size of the conntrack table (hash buckets).

  net.netfilter.nf_conntrack_expect_max
  .. maximum number of permitted expectations in this netns.

  net.netfilter.nf_conntrack_helper
  .. conntrack helper auto assignment.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
index 4912069627b651fcad837f40eb208553bf55cdc5..9b57330c81f8ee464b69d076cd0b3830ebbcfbc5 100644 (file)
--- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c
@@ -1054,21 +1054,18 @@ static int nf_conntrack_standalone_init_sysctl(struct net *net)
        nf_conntrack_standalone_init_dccp_sysctl(net, table);
        nf_conntrack_standalone_init_gre_sysctl(net, table);
 
-       /* Don't export sysctls to unprivileged users */
+       /* Don't allow unprivileged users to alter certain sysctls */
        if (net->user_ns != &init_user_ns) {
-               table[NF_SYSCTL_CT_MAX].procname = NULL;
-               table[NF_SYSCTL_CT_ACCT].procname = NULL;
-               table[NF_SYSCTL_CT_HELPER].procname = NULL;
-#ifdef CONFIG_NF_CONNTRACK_TIMESTAMP
-               table[NF_SYSCTL_CT_TIMESTAMP].procname = NULL;
-#endif
+               table[NF_SYSCTL_CT_MAX].mode = 0444;
+               table[NF_SYSCTL_CT_EXPECT_MAX].mode = 0444;
+               table[NF_SYSCTL_CT_HELPER].mode = 0444;
 #ifdef CONFIG_NF_CONNTRACK_EVENTS
-               table[NF_SYSCTL_CT_EVENTS].procname = NULL;
+               table[NF_SYSCTL_CT_EVENTS].mode = 0444;
 #endif
-       }
-
-       if (!net_eq(&init_net, net))
                table[NF_SYSCTL_CT_BUCKETS].mode = 0444;
+       } else if (!net_eq(&init_net, net)) {
+               table[NF_SYSCTL_CT_BUCKETS].mode = 0444;
+       }
 
        net->ct.sysctl_header = register_net_sysctl(net, "net/netfilter", table);
        if (!net->ct.sysctl_header)