diff options
author | Daniel Lezcano <dlezcano@fr.ibm.com> | 2008-01-10 05:57:43 -0500 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2008-01-28 18:01:19 -0500 |
commit | 7c76509d0da99f29289b9b7ab134791e45d49b15 (patch) | |
tree | 6cff76a24da35a80106dadfa8669a4a92b971f77 | |
parent | e71e0349eb32bc438fa80d8990c6f3592967d111 (diff) |
[NETNS][IPV6]: Make mld_max_msf readonly in other namespaces.
The mld_max_msf protects the system with a maximum allowed multicast
source filters. Making this variable per namespace can be potentially
an problem if someone inside a namespace set it to a big value, that
will impact the whole system including other namespaces.
I don't see any benefits to have it per namespace for now, so in order
to keep a directory entry in a newly created namespace, I make it
read-only when we are not in the initial network namespace.
Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r-- | net/ipv6/sysctl_net_ipv6.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/net/ipv6/sysctl_net_ipv6.c b/net/ipv6/sysctl_net_ipv6.c index ae3cfd1b8e0e..d223159638d3 100644 --- a/net/ipv6/sysctl_net_ipv6.c +++ b/net/ipv6/sysctl_net_ipv6.c | |||
@@ -122,6 +122,12 @@ static int ipv6_sysctl_net_init(struct net *net) | |||
122 | ipv6_table[5].data = &net->ipv6.sysctl.frags.timeout; | 122 | ipv6_table[5].data = &net->ipv6.sysctl.frags.timeout; |
123 | ipv6_table[6].data = &net->ipv6.sysctl.frags.secret_interval; | 123 | ipv6_table[6].data = &net->ipv6.sysctl.frags.secret_interval; |
124 | 124 | ||
125 | /* We don't want this value to be per namespace, it should be global | ||
126 | to all namespaces, so make it read-only when we are not in the | ||
127 | init network namespace */ | ||
128 | if (net != &init_net) | ||
129 | ipv6_table[7].mode = 0444; | ||
130 | |||
125 | net->ipv6.sysctl.table = register_net_sysctl_table(net, net_ipv6_ctl_path, | 131 | net->ipv6.sysctl.table = register_net_sysctl_table(net, net_ipv6_ctl_path, |
126 | ipv6_table); | 132 | ipv6_table); |
127 | if (!net->ipv6.sysctl.table) | 133 | if (!net->ipv6.sysctl.table) |