ipv6: enable net.ipv6.route.max_size sysctl in network namespace

We want to increase route cache size in network namespace
created with user namespace. Currently ipv6 route settings
are disabled for non-initial network namespaces.
We can allow this sysctl and it will be safe since
commit <6126891c6d4f> because route cache account to kmem,
that is why users from user namespace can not DOS system.

Signed-off-by: Alexander Kuznetsov <wwfq@yandex-team.ru>
Acked-by: Dmitry Yakunin <zeil@yandex-team.ru>
Acked-by: Dmitry Monakhov <dmtrmonakhov@yandex-team.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 9b9ef09382ab911b25e03b2ed7000c24411bf5cb..3ae25b8ffbd6fbeda4b46438dc14b11235558f10 100644 (file)
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -6306,11 +6306,11 @@ static int ipv6_sysctl_rtcache_flush(struct ctl_table *ctl, int write,
 
 static struct ctl_table ipv6_route_table_template[] = {
        {
-               .procname       =       "flush",
-               .data           =       &init_net.ipv6.sysctl.flush_delay,
+               .procname       =       "max_size",
+               .data           =       &init_net.ipv6.sysctl.ip6_rt_max_size,
                .maxlen         =       sizeof(int),
-               .mode           =       0200,
-               .proc_handler   =       ipv6_sysctl_rtcache_flush
+               .mode           =       0644,
+               .proc_handler   =       proc_dointvec,
        },
        {
                .procname       =       "gc_thresh",
@@ -6320,11 +6320,11 @@ static struct ctl_table ipv6_route_table_template[] = {
                .proc_handler   =       proc_dointvec,
        },
        {
-               .procname       =       "max_size",
-               .data           =       &init_net.ipv6.sysctl.ip6_rt_max_size,
+               .procname       =       "flush",
+               .data           =       &init_net.ipv6.sysctl.flush_delay,
                .maxlen         =       sizeof(int),
-               .mode           =       0644,
-               .proc_handler   =       proc_dointvec,
+               .mode           =       0200,
+               .proc_handler   =       ipv6_sysctl_rtcache_flush
        },
        {
                .procname       =       "gc_min_interval",
@@ -6396,10 +6396,10 @@ struct ctl_table * __net_init ipv6_route_sysctl_init(struct net *net)
                        GFP_KERNEL);
 
        if (table) {
-               table[0].data = &net->ipv6.sysctl.flush_delay;
-               table[0].extra1 = net;
+               table[0].data = &net->ipv6.sysctl.ip6_rt_max_size;
                table[1].data = &net->ipv6.ip6_dst_ops.gc_thresh;
-               table[2].data = &net->ipv6.sysctl.ip6_rt_max_size;
+               table[2].data = &net->ipv6.sysctl.flush_delay;
+               table[2].extra1 = net;
                table[3].data = &net->ipv6.sysctl.ip6_rt_gc_min_interval;
                table[4].data = &net->ipv6.sysctl.ip6_rt_gc_timeout;
                table[5].data = &net->ipv6.sysctl.ip6_rt_gc_interval;
@@ -6411,7 +6411,7 @@ struct ctl_table * __net_init ipv6_route_sysctl_init(struct net *net)
 
                /* Don't export sysctls to unprivileged users */
                if (net->user_ns != &init_user_ns)
-                       table[0].procname = NULL;
+                       table[1].procname = NULL;
        }
 
        return table;