ipv4: enable route flushing in network namespaces (5cdda5f1) · Commits · 戴 / test

Tools such as vpnc try to flush routes when run inside network namespaces by writing 1 into /proc/sys/net/ipv4/route/flush. This currently does not work because flush is not enabled in non-initial network namespaces. Since routes are per network namespace it is safe to enable /proc/sys/net/ipv4/route/flush in there. Link: https://github.com/lxc/lxd/issues/4257 Signed-off-by:

Christian Brauner <christian.brauner@ubuntu.com> Signed-off-by:

David S. Miller <davem@davemloft.net>

net/ipv4/route.c

+8 −4

Original line number	Diff line number	Diff line
		@@ -3326,9 +3326,11 @@ static struct ctl_table ipv4_route_table[] = {
		{ }
		};

		static const char ipv4_route_flush_procname[] = "flush";

		static struct ctl_table ipv4_route_flush_table[] = {
		{
		.procname = "flush",
		.procname = ipv4_route_flush_procname,
		.maxlen = sizeof(int),
		.mode = 0200,
		.proc_handler = ipv4_sysctl_rtcache_flush,
		@@ -3346,10 +3348,12 @@ static __net_init int sysctl_route_net_init(struct net *net)
		if (!tbl)
		goto err_dup;

		/* Don't export sysctls to unprivileged users */
		if (net->user_ns != &init_user_ns)
		/* Don't export non-whitelisted sysctls to unprivileged users */
		if (net->user_ns != &init_user_ns) {
		if (tbl[0].procname != ipv4_route_flush_procname)
		tbl[0].procname = NULL;
		}
		}
		tbl[0].extra1 = net;

		net->ipv4.route_hdr = register_net_sysctl(net, "net/ipv4/route", tbl);

Admin message