Re: [PATCH nf] netfilter: lwtunnel: expose read-only sysctl nf_hooks_lwtunnel for non init-netns
Florian Westphal <[email protected]>
| Newsgroups | gmane.comp.security.firewalls.netfilter.devel |
|---|---|
| Message-ID | <[email protected]> |
Pablo Neira Ayuso <[email protected]> wrote: > Expose nf_hooks_lwtunnel sysctl with 0444 mode from non init-netns > instead of 0644, sashiko reports this is exposing a global static branch > to modification by unprivileged users. No objection but I find this report weird. Why is that an issue in the first place? > Fixes: a2225e0250c5 ("netfilter: move the sysctl nf_hooks_lwtunnel into the netfilter core") AFAICS it was exposed before this too, just via conntrack module and not the core.