The ip_vs kernel module does not exist in the unprivileged container /proc

LXD
3

It’s currently not namespaced:

if (!net_eq(net, &init_net)) {
	tbl = kmemdup(vs_vars, sizeof(vs_vars), GFP_KERNEL);
	if (tbl == NULL)
		return -ENOMEM;

	/* Don't export sysctls to unprivileged users */
	if (net->user_ns != &init_user_ns)
		tbl[0].procname = NULL;
} else
	tbl = vs_vars;

I currently have no idea whether this is safe to do. We could put it as
“to investigate” on the next roadmap.

4 Likes