github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-23 11:50:44 +00:00
Code Issues Projects Releases Wiki Activity

add ip_local_reserved_ports to safe sysctl allow list only if kernel version >= 3.16

Browse Source
This commit is contained in:
Paco Xu 2023-03-02 12:40:42 +08:00
parent a5252e93cf
commit bea956568f
1 changed files with 31 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
pkg/kubelet/sysctl/safe_sysctls.go
View File

@ -16,12 +16,43 @@ limitations under the License.
package sysctl package sysctl
import (
"k8s.io/apimachinery/pkg/util/version"
"k8s.io/klog/v2"
"k8s.io/kubernetes/pkg/proxy/ipvs"
)
const ipLocalReservedPortsMinNamespacedKernelVersion = "3.16"
var safeSysctls = []string{
"kernel.shm_rmid_forced",
"net.ipv4.ip_local_port_range",
"net.ipv4.tcp_syncookies",
"net.ipv4.ping_group_range",
"net.ipv4.ip_unprivileged_port_start",
}
// SafeSysctlAllowlist returns the allowlist of safe sysctls and safe sysctl patterns (ending in *). // SafeSysctlAllowlist returns the allowlist of safe sysctls and safe sysctl patterns (ending in *).
// //
// A sysctl is called safe iff // A sysctl is called safe iff
// - it is namespaced in the container or the pod // - it is namespaced in the container or the pod
// - it is isolated, i.e. has no influence on any other pod on the same node. // - it is isolated, i.e. has no influence on any other pod on the same node.
func SafeSysctlAllowlist() []string { func SafeSysctlAllowlist() []string {
kernelVersionStr, err := ipvs.NewLinuxKernelHandler().GetKernelVersion()
if err != nil {
klog.ErrorS(err, "Failed to get kernel version.")
return safeSysctls
}
kernelVersion, err := version.ParseGeneric(kernelVersionStr)
if err != nil {
klog.ErrorS(err, "Failed to parse kernel version.")
return safeSysctls
}
// ip_local_reserved_ports has been changed to namesapced since kernel v3.16.
// refer to https://github.com/torvalds/linux/commit/122ff243f5f104194750ecbc76d5946dd1eec934.
if kernelVersion.LessThan(version.MustParseGeneric(ipLocalReservedPortsMinNamespacedKernelVersion)) {
return safeSysctls
}
return []string{ return []string{
"kernel.shm_rmid_forced", "kernel.shm_rmid_forced",
"net.ipv4.ip_local_port_range", "net.ipv4.ip_local_port_range",