Expose nf_hooks_lwtunnel sysctl with 0444 mode from non init-netns instead of 0644, sashiko reports this is exposing a global static branch to modification by unprivileged users. Fixes: a2225e0250c5 ("netfilter: move the sysctl nf_hooks_lwtunnel into the netfilter core") Signed-off-by: Pablo Neira Ayuso --- net/netfilter/nf_hooks_lwtunnel.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/net/netfilter/nf_hooks_lwtunnel.c b/net/netfilter/nf_hooks_lwtunnel.c index 4e1eef1ba0f1..0b4fca26233f 100644 --- a/net/netfilter/nf_hooks_lwtunnel.c +++ b/net/netfilter/nf_hooks_lwtunnel.c @@ -68,14 +68,18 @@ static int __net_init nf_lwtunnel_net_init(struct net *net) { const struct ctl_table *table; struct ctl_table_header *hdr; + struct ctl_table *dup; table = nf_lwtunnel_sysctl_table; if (!net_eq(net, &init_net)) { - table = kmemdup(nf_lwtunnel_sysctl_table, - sizeof(nf_lwtunnel_sysctl_table), - GFP_KERNEL); - if (!table) + dup = kmemdup(nf_lwtunnel_sysctl_table, + sizeof(nf_lwtunnel_sysctl_table), + GFP_KERNEL); + if (!dup) goto err_alloc; + + dup->mode = 0444; + table = dup; } hdr = register_net_sysctl_sz(net, "net/netfilter", table, -- 2.47.3