net: make net.core.{r,w}mem_{default,max} namespaced

The following sysctl are global and can't be read from a netns:

net.core.rmem_default
net.core.rmem_max
net.core.wmem_default
net.core.wmem_max

Make the following sysctl parameters available readonly from within a
network namespace, allowing a container to read them.

Signed-off-by: Matteo Croce <teknoraver@meta.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Shakeel Butt <shakeel.butt@linux.dev>
Link: https://lore.kernel.org/r/20240530232722.45255-2-technoboy85@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
index c9fb9ad874857311537cd50924e29caa6d202e07..2079000691e286ef753063b69586c7d297d175cb 100644 (file)
--- a/net/core/sysctl_net_core.c
+++ b/net/core/sysctl_net_core.c
@@ -382,38 +382,6 @@ proc_dolongvec_minmax_bpf_restricted(struct ctl_table *table, int write,
 #endif
 
 static struct ctl_table net_core_table[] = {
-       {
-               .procname       = "wmem_max",
-               .data           = &sysctl_wmem_max,
-               .maxlen         = sizeof(int),
-               .mode           = 0644,
-               .proc_handler   = proc_dointvec_minmax,
-               .extra1         = &min_sndbuf,
-       },
-       {
-               .procname       = "rmem_max",
-               .data           = &sysctl_rmem_max,
-               .maxlen         = sizeof(int),
-               .mode           = 0644,
-               .proc_handler   = proc_dointvec_minmax,
-               .extra1         = &min_rcvbuf,
-       },
-       {
-               .procname       = "wmem_default",
-               .data           = &sysctl_wmem_default,
-               .maxlen         = sizeof(int),
-               .mode           = 0644,
-               .proc_handler   = proc_dointvec_minmax,
-               .extra1         = &min_sndbuf,
-       },
-       {
-               .procname       = "rmem_default",
-               .data           = &sysctl_rmem_default,
-               .maxlen         = sizeof(int),
-               .mode           = 0644,
-               .proc_handler   = proc_dointvec_minmax,
-               .extra1         = &min_rcvbuf,
-       },
        {
                .procname       = "mem_pcpu_rsv",
                .data           = &net_hotdata.sysctl_mem_pcpu_rsv,
@@ -697,6 +665,41 @@ static struct ctl_table netns_core_table[] = {
                .extra2         = SYSCTL_ONE,
                .proc_handler   = proc_dou8vec_minmax,
        },
+       /* sysctl_core_net_init() will set the values after this
+        * to readonly in network namespaces
+        */
+       {
+               .procname       = "wmem_max",
+               .data           = &sysctl_wmem_max,
+               .maxlen         = sizeof(int),
+               .mode           = 0644,
+               .proc_handler   = proc_dointvec_minmax,
+               .extra1         = &min_sndbuf,
+       },
+       {
+               .procname       = "rmem_max",
+               .data           = &sysctl_rmem_max,
+               .maxlen         = sizeof(int),
+               .mode           = 0644,
+               .proc_handler   = proc_dointvec_minmax,
+               .extra1         = &min_rcvbuf,
+       },
+       {
+               .procname       = "wmem_default",
+               .data           = &sysctl_wmem_default,
+               .maxlen         = sizeof(int),
+               .mode           = 0644,
+               .proc_handler   = proc_dointvec_minmax,
+               .extra1         = &min_sndbuf,
+       },
+       {
+               .procname       = "rmem_default",
+               .data           = &sysctl_rmem_default,
+               .maxlen         = sizeof(int),
+               .mode           = 0644,
+               .proc_handler   = proc_dointvec_minmax,
+               .extra1         = &min_rcvbuf,
+       },
 };
 
 static int __init fb_tunnels_only_for_init_net_sysctl_setup(char *str)
@@ -724,8 +727,14 @@ static __net_init int sysctl_core_net_init(struct net *net)
                if (tbl == NULL)
                        goto err_dup;
 
-               for (i = 0; i < table_size; ++i)
+               for (i = 0; i < table_size; ++i) {
+                       if (tbl[i].data == &sysctl_wmem_max)
+                               break;
+
                        tbl[i].data += (char *)net - (char *)&init_net;
+               }
+               for (; i < table_size; ++i)
+                       tbl[i].mode &= ~0222;
        }
 
        net->core.sysctl_hdr = register_net_sysctl_sz(net, "net/core", tbl, table_size);