Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Mon, 24 Jun 2019 21:59:21 +0200
User-Agent: K-9 Mail for Android
In-Reply-To: <56ed92eb-14db-789a-c226-cdf8a5862e61@gmail.com>
References: <20190624132923.16792-1-christian@brauner.io> <56ed92eb-14db-789a-c226-cdf8a5862e61@gmail.com>
MIME-Version: 1.0
Content-Type: text/plain;
 charset=utf-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PATCH net-next] ipv4: enable route flushing in network namespaces
To:     David Ahern <dsahern@gmail.com>, davem@davemloft.net,
        kuznet@ms2.inr.ac.ru, yoshfuji@linux-ipv6.org,
        netdev@vger.kernel.org
CC:     linux-kernel@vger.kernel.org
From:   Christian Brauner <christian@brauner.io>
Message-ID: <06CDD3C2-8B7F-4346-9653-44A29E28374A@brauner.io>
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On June 24, 2019 9:49:33 PM GMT+02:00, David Ahern <dsahern@gmail=2Ecom> wr=
ote:
>On 6/24/19 7:29 AM, Christian Brauner wrote:
>> Tools such as vpnc try to flush routes when run inside network
>> namespaces by writing 1 into /proc/sys/net/ipv4/route/flush=2E This
>> currently does not work because flush is not enabled in non-initial
>> network namespaces=2E
>> Since routes are per network namespace it is safe to enable
>> /proc/sys/net/ipv4/route/flush in there=2E
>>=20
>> Link: https://github=2Ecom/lxc/lxd/issues/4257
>> Signed-off-by: Christian Brauner <christian=2Ebrauner@ubuntu=2Ecom>
>> ---
>>  net/ipv4/route=2Ec | 12 ++++++++----
>>  1 file changed, 8 insertions(+), 4 deletions(-)
>>=20
>
>why not teach vpnc to use rtnetlink and then add a flush option to
>RTM_DELROUTE?

I think that if you can do it unprivileged through netlink
you should also allow it through sysctls=2E
Even the original commit references it
to make it possible to enable the sysctls
1-by-1 as needed=2E