[PATCH] netns: restrict uevents to initial user namespace

From: Christian Brauner
Date: Tue Apr 10 2018 - 05:56:49 EST


/* Here'll be a useful commit message describing in detail what's
* happening once I sent it to net-next. */

Signed-off-by: Christian Brauner <christian.brauner@xxxxxxxxxx>
---
lib/kobject_uevent.c | 21 +++++++++++++++------
1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c
index 15ea216a67ce..22a2c1a98b8f 100644
--- a/lib/kobject_uevent.c
+++ b/lib/kobject_uevent.c
@@ -703,9 +703,16 @@ static int uevent_net_init(struct net *net)

net->uevent_sock = ue_sk;

- mutex_lock(&uevent_sock_mutex);
- list_add_tail(&ue_sk->list, &uevent_sock_list);
- mutex_unlock(&uevent_sock_mutex);
+ /*
+ * Only sent uevents to uevent sockets that are located in network
+ * namespaces owned by the initial user namespace.
+ */
+ if (sock_net(ue_sk->sk)->user_ns == &init_user_ns) {
+ mutex_lock(&uevent_sock_mutex);
+ list_add_tail(&ue_sk->list, &uevent_sock_list);
+ mutex_unlock(&uevent_sock_mutex);
+ }
+
return 0;
}

@@ -713,9 +720,11 @@ static void uevent_net_exit(struct net *net)
{
struct uevent_sock *ue_sk = net->uevent_sock;

- mutex_lock(&uevent_sock_mutex);
- list_del(&ue_sk->list);
- mutex_unlock(&uevent_sock_mutex);
+ if (sock_net(ue_sk->sk)->user_ns == &init_user_ns) {
+ mutex_lock(&uevent_sock_mutex);
+ list_del(&ue_sk->list);
+ mutex_unlock(&uevent_sock_mutex);
+ }

netlink_kernel_release(ue_sk->sk);
kfree(ue_sk);
--
2.15.1

>
> Thank you for tracking down what is going on.

Sure! Thanks for properly poking at this.

Christian