• Michal Kubeček's avatar
    netfilter: allow logging from non-init namespaces · 2851940f
    Michal Kubeček authored
    Commit 69b34fb9 ("netfilter: xt_LOG: add net namespace support for
    xt_LOG") disabled logging packets using the LOG target from non-init
    namespaces. The motivation was to prevent containers from flooding
    kernel log of the host. The plan was to keep it that way until syslog
    namespace implementation allows containers to log in a safe way.
    
    However, the work on syslog namespace seems to have hit a dead end
    somewhere in 2013 and there are users who want to use xt_LOG in all
    network namespaces. This patch allows to do so by setting
    
      /proc/sys/net/netfilter/nf_log_all_netns
    
    to a nonzero value. This sysctl is only accessible from init_net so that
    one cannot switch the behaviour from inside a container.
    Signed-off-by: default avatarMichal Kubecek <mkubecek@suse.cz>
    Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
    2851940f
netfilter-sysctl.txt 371 Bytes