SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

nsresourced: put a limit on delegated network interfaces too

Browse Source
This commit is contained in:
Lennart Poettering
2025-03-17 16:03:18 +01:00
parent 7d2e2900f1
commit b2c43674a7
3 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/nsresourced/nsresourcework.c
+3
View File
@@ -1742,6 +1742,9 @@ static int vl_method_add_netif_to_user_namespace(sd_varlink *link, sd_json_varia
if (r < 0)
return r;
if (strv_length(userns_info->netifs) > USER_NAMESPACE_NETIFS_DELEGATE_MAX)
return sd_varlink_error(link, "io.systemd.NamespaceResource.TooManyNetworkInterfaces", NULL);
/* Registering a network interface for this client is only allowed for the root or the owner of a userns */
uid_t peer_uid;
r = sd_varlink_get_peer_uid(link, &peer_uid);
src/nsresourced/userns-registry.h
+2 -1
View File
@@ -3,7 +3,8 @@
#include "macro.h"
#define USER_NAMESPACE_CGROUPS_DELEGATE_MAX 16
#define USER_NAMESPACE_CGROUPS_DELEGATE_MAX 16U
#define USER_NAMESPACE_NETIFS_DELEGATE_MAX 16U
typedef struct UserNamespaceInfo {
uid_t owner;
src/shared/varlink-io.systemd.NamespaceResource.c
+3 -1
View File
@@ -57,6 +57,7 @@ static SD_VARLINK_DEFINE_ERROR(UserNamespaceNotRegistered);
static SD_VARLINK_DEFINE_ERROR(UserNamespaceWithoutUserRange);
static SD_VARLINK_DEFINE_ERROR(TooManyControlGroups);
static SD_VARLINK_DEFINE_ERROR(ControlGroupAlreadyAdded);
static SD_VARLINK_DEFINE_ERROR(TooManyNetworkInterfaces);
SD_VARLINK_DEFINE_INTERFACE(
io_systemd_NamespaceResource,
@@ -74,4 +75,5 @@ SD_VARLINK_DEFINE_INTERFACE(
&vl_error_UserNamespaceNotRegistered,
&vl_error_UserNamespaceWithoutUserRange,
&vl_error_TooManyControlGroups,
&vl_error_ControlGroupAlreadyAdded);
&vl_error_ControlGroupAlreadyAdded,
&vl_error_TooManyNetworkInterfaces);