{"id":20793659,"url":"https://github.com/jonathonreinhart/linux-netns-sysctl-verify","last_synced_at":"2025-05-05T23:32:08.004Z","repository":{"id":52291744,"uuid":"363322052","full_name":"JonathonReinhart/linux-netns-sysctl-verify","owner":"JonathonReinhart","description":"Linux network namespace sysctl safety verifier.","archived":false,"fork":false,"pushed_at":"2021-06-20T06:08:23.000Z","size":38,"stargazers_count":11,"open_issues_count":4,"forks_count":1,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-03-31T00:51:10.485Z","etag":null,"topics":["containers","docker","libvirt","linux-kernel","sysctl"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/JonathonReinhart.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2021-05-01T04:29:21.000Z","updated_at":"2024-03-03T18:07:46.000Z","dependencies_parsed_at":"2022-09-14T13:40:51.866Z","dependency_job_id":null,"html_url":"https://github.com/JonathonReinhart/linux-netns-sysctl-verify","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/JonathonReinhart%2Flinux-netns-sysctl-verify","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/JonathonReinhart%2Flinux-netns-sysctl-verify/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/JonathonReinhart%2Flinux-netns-sysctl-verify/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/JonathonReinhart%2Flinux-netns-sysctl-verify/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/JonathonReinhart","download_url":"https://codeload.github.com/JonathonReinhart/linux-netns-sysctl-verify/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":252592933,"owners_count":21773364,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["containers","docker","libvirt","linux-kernel","sysctl"],"created_at":"2024-11-17T16:10:47.583Z","updated_at":"2025-05-05T23:32:07.987Z","avatar_url":"https://github.com/JonathonReinhart.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"linux-netns-sysctl-verify\n=========================\nLinux network namespace sysctl safety verifier.\n\nEnsure that `net` sysctls are network-namespace-safe.\n\n# Usage\n\n```\nusage: verify.py [-h] [-v]\n\noptional arguments:\n  -h, --help     show this help message and exit\n  -v, --verbose  Verbose output\n```\n\nCurrently, this must be run as root, in order to use `CLONE_NEWNET`.\n\n```\n$ sudo ./verify.py -v\n```\n\n# Theory of Operation\nThe premise behind this tool is simple:\n- Take a snapshot of all values in `/proc/sys/net`.\n- Create a child process with a new netns (using `CLONE_NEWNET`).\n- In the child netns, modify every writable value in `/proc/sys/net`.\n- Exit the child netns.\n- Take a second snapshot of `/proc/sys/net`.\n- Compare the snapshots and report any differences.\n\nAnything in the parent which changed as a result of manipulations in the child\nis considered a \"leak\".\n\n\n# Background\nThe Linux kernel provides runtime-configurable kernel parameters known as\n[\"sysctls\"][sysctl], which are accessed via `/proc/sys/`.\n\nLinux also supports supports *network namespaces* (netns) which enable isolated\nvirtual network stacks and are used heavily by containerization platforms like\n[LXC] or [Docker]. See [`network_namespaces(7)`][network_namespaces].\n\nIt's generally understood that the \"net\" sysctls (under `/proc/sys/net`) are\nsupposed to be \"netns safe\", meaning that manipulating sysctls from one network\nnamespace cannot affect any other network namespace. This isn't exactly\nguaranteed, though.\n\nIt may be desirable to allow a container to write to net sysctls, specifically\nparameters of devices which exist only within the container's netns.  However,\nthe latest version of Docker (20.10.6 as of this writing) mounts all of\n`/proc/sys` read-only, to prevent changes made in a container from \"leaking\"\nout of the container. This protection mechanism makes it more difficult (and\nless secure) to run a [libvirt] QEMU VM inside of a Docker container.\n\nThis tool was inspired by conversation on [this runc issue][runc_2826].\n\n# Results\nUse of this tool helped to uncover several bugs in the Linux kernel's\nimplementation of several sysctls, which have been subsequently fixed by this\ntool's author:\n\n**Bug 1**: Several `nf_conntrack` sysctls are global and writable by any netns\n- Affected sysctls:\n  - `net.nf_conntrack_max`\n  - `net.netfilter.nf_conntrack_max`\n  - `net.netfilter.nf_conntrack_expect_max`\n- First broken: (long ago; since introduction of net namespaces)\n- Fix: `netfilter: conntrack: Make global sysctls readonly in non-init netns`\n- Fixed in Kernels:\n  - 5.13+: `v5.13-rc1` ([`2671fa4dc010`](https://github.com/gregkh/linux/commit/2671fa4dc010))\n  - 5.12: `v5.12.2` ([`671c54ea8c7f`](https://github.com/gregkh/linux/commit/671c54ea8c7f))\n  - 5.11: `v5.11.19` ([`fbf85a34ce17`](https://github.com/gregkh/linux/commit/fbf85a34ce17))\n  - 5.10: `v5.10.35` ([`d3598eb3915c`](https://github.com/gregkh/linux/commit/d3598eb3915c))\n  - 5.4: `v5.4.120` ([`baea536cf51f`](https://github.com/gregkh/linux/commit/baea536cf51f))\n  - 4.19: `v4.19.191` ([`9b288479f7a9`](https://github.com/gregkh/linux/commit/9b288479f7a9))\n  - 4.14: `v4.14.233` ([`68122479c128`](https://github.com/gregkh/linux/commit/68122479c128))\n  - 4.9: `v4.9.269` ([`da50f56e826e`](https://github.com/gregkh/linux/commit/da50f56e826e))\n\n**Bug 2**: `tcp_allowed_congestion_control` is global and writable by any netns\n- Affected sysctls:\n  - `net.ipv4.tcp_allowed_congestion_control`\n- First broken: v5.7\n- Fix: `net: Make tcp_allowed_congestion_control readonly in non-init netns`\n- Fixed in Kernels:\n  - 5.12+: `v5.12-rc8` ([`97684f0970f6`](https://github.com/gregkh/linux/commit/97684f0970f6))\n  - 5.11: `v5.11.16` ([`1ccdf1bed140`](https://github.com/gregkh/linux/commit/1ccdf1bed140))\n  - 5.10: `v5.10.32` ([`35d7491e2f77`](https://github.com/gregkh/linux/commit/35d7491e2f77))\n  - 5.4: (n/a)\n  - 4.19: (n/a)\n  - 4.14: (n/a)\n  - 4.4: (n/a)\n\n**Bug 3**: Setting `tcp_congestion_control` can globally affect `tcp_allowed_congestion_control`\n- Related sysctls:\n  - `net.ipv4.tcp_congestion_control` (affects)\n  - `net.ipv4.tcp_allowed_congestion_control` (affected)\n- First broken: v4.15\n- Fix: `net: Only allow init netns to set default tcp cong to a restricted algo`\n- Fixed in Kernels:\n  - 5.13+: `v5.13-rc1` ([`8d432592f30f`](https://github.com/gregkh/linux/commit/8d432592f30f))\n  - 5.12: `v5.12.4` ([`e7d7bedd507b`](https://github.com/gregkh/linux/commit/e7d7bedd507b))\n  - 5.11: `v5.11.21` ([`efe1532a6e1a`](https://github.com/gregkh/linux/commit/efe1532a6e1a))\n  - 5.10: `v5.10.37` ([`6c1ea8bee75d`](https://github.com/gregkh/linux/commit/6c1ea8bee75d))\n  - 5.4: `v5.4.119` ([`9884f745108f`](https://github.com/gregkh/linux/commit/9884f745108f))\n  - 4.19: `v4.19.191` ([`992de06308d9`](https://github.com/gregkh/linux/commit/992de06308d9))\n  - 4.14: (n/a)\n  - 4.9: (n/a)\n\n\nAdditionally, a safety check was added to the kernel to prevent\ncertain classes of bugs from going unnoticed:\n\n- [`31c4d2f160eb`](https://github.com/gregkh/linux/commit/31c4d2f160eb):\n  `net: Ensure net namespace isolation of sysctls`\n\n\n[sysctl]: https://man7.org/linux/man-pages/man8/sysctl.8.html\n[network_namespaces]: https://man7.org/linux/man-pages/man7/network_namespaces.7.html\n[LXC]: https://linuxcontainers.org/\n[Docker]: https://docs.docker.com/get-started/overview/\n[libvirt]: https://libvirt.org/\n[runc_2826]: https://github.com/opencontainers/runc/issues/2826\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjonathonreinhart%2Flinux-netns-sysctl-verify","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjonathonreinhart%2Flinux-netns-sysctl-verify","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjonathonreinhart%2Flinux-netns-sysctl-verify/lists"}