netfilter: allow logging from non-init namespaces

Commit 69b34fb996b2 ("netfilter: xt_LOG: add net namespace support for
xt_LOG") disabled logging packets using the LOG target from non-init
namespaces. The motivation was to prevent containers from flooding
kernel log of the host. The plan was to keep it that way until syslog
namespace implementation allows containers to log in a safe way.

However, the work on syslog namespace seems to have hit a dead end
somewhere in 2013 and there are users who want to use xt_LOG in all
network namespaces. This patch allows to do so by setting

  /proc/sys/net/netfilter/nf_log_all_netns

to a nonzero value. This sysctl is only accessible from init_net so that
one cannot switch the behaviour from inside a container.

Signed-off-by: Michal Kubecek <mkubecek@suse.cz>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

1 files changed, 24 insertions, 0 deletions

diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c

path: root/bpf_ext.h

#ifndef BPF_EXT
#define BPF_EXT

#ifndef SKF_AD_OFF
# define SKF_AD_OFF			(-0x1000)
#endif
#ifndef SKF_AD_PROTOCOL
# define SKF_AD_PROTOCOL		0
#endif
#ifndef SKF_AD_PKTTYPE
# define SKF_AD_PKTTYPE			4
#endif
#ifndef SKF_AD_IFINDEX
# define SKF_AD_IFINDEX			8
#endif
#ifndef SKF_AD_NLATTR
# define SKF_AD_NLATTR			12
#endif
#ifndef SKF_AD_NLATTR_NEST
# define SKF_AD_NLATTR_NEST		16
#endif
#ifndef SKF_AD_MARK
# define SKF_AD_MARK			20
#endif
#ifndef SKF_AD_QUEUE
# define SKF_AD_QUEUE			24
#endif
#ifndef SKF_AD_HATYPE
# define SKF_AD_HATYPE			28
#endif
#ifndef SKF_AD_RXHASH
# define SKF_AD_RXHASH			32
#endif
#ifndef SKF_AD_CPU
# define SKF_AD_CPU			36
#endif
#ifndef SKF_AD_VLAN_TAG
# define SKF_AD_VLAN_TAG		44
#endif
#ifndef SKF_AD_VLAN_TAG_PRESENT
# define SKF_AD_VLAN_TAG_PRESENT	48
#endif
#ifndef SKF_AD_PAY_OFFSET
# define SKF_AD_PAY_OFFSET		52
#endif

#endif /* BPF_EXT */