diff options
| author | Michal Kubeček <mkubecek@suse.cz> | 2017-01-31 10:30:06 +0100 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2017-02-02 14:31:58 +0100 |
| commit | 2851940ffee313e0ff12540a8e11a8c54dea9c65 (patch) | |
| tree | 0fe2bf02a3125fc7a13800ded0d34812fda92e60 /Documentation/networking | |
| parent | ipvs: free ip_vs_dest structs when refcnt=0 (diff) | |
| download | linux-2851940ffee313e0ff12540a8e11a8c54dea9c65.tar.xz linux-2851940ffee313e0ff12540a8e11a8c54dea9c65.zip | |
netfilter: allow logging from non-init namespaces
Commit 69b34fb996b2 ("netfilter: xt_LOG: add net namespace support for
xt_LOG") disabled logging packets using the LOG target from non-init
namespaces. The motivation was to prevent containers from flooding
kernel log of the host. The plan was to keep it that way until syslog
namespace implementation allows containers to log in a safe way.
However, the work on syslog namespace seems to have hit a dead end
somewhere in 2013 and there are users who want to use xt_LOG in all
network namespaces. This patch allows to do so by setting
/proc/sys/net/netfilter/nf_log_all_netns
to a nonzero value. This sysctl is only accessible from init_net so that
one cannot switch the behaviour from inside a container.
Signed-off-by: Michal Kubecek <mkubecek@suse.cz>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'Documentation/networking')
| -rw-r--r-- | Documentation/networking/netfilter-sysctl.txt | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/Documentation/networking/netfilter-sysctl.txt b/Documentation/networking/netfilter-sysctl.txt new file mode 100644 index 000000000000..55791e50e169 --- /dev/null +++ b/Documentation/networking/netfilter-sysctl.txt @@ -0,0 +1,10 @@ +/proc/sys/net/netfilter/* Variables: + +nf_log_all_netns - BOOLEAN + 0 - disabled (default) + not 0 - enabled + + By default, only init_net namespace can log packets into kernel log + with LOG target; this aims to prevent containers from flooding host + kernel log. If enabled, this target also works in other network + namespaces. This variable is only accessible from init_net. |