• Krister Johansen's avatar
    Introduce a sysctl that modifies the value of PROT_SOCK. · 4548b683
    Krister Johansen authored
    Add net.ipv4.ip_unprivileged_port_start, which is a per namespace sysctl
    that denotes the first unprivileged inet port in the namespace.  To
    disable all privileged ports set this to zero.  It also checks for
    overlap with the local port range.  The privileged and local range may
    not overlap.
    
    The use case for this change is to allow containerized processes to bind
    to priviliged ports, but prevent them from ever being allowed to modify
    their container's network configuration.  The latter is accomplished by
    ensuring that the network namespace is not a child of the user
    namespace.  This modification was needed to allow the container manager
    to disable a namespace's priviliged port restrictions without exposing
    control of the network namespace to processes in the user namespace.
    Signed-off-by: default avatarKrister Johansen <kjlx@templeofstupid.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    4548b683
socket.c 221 KB