archives/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-03-08 01:04:41 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

vsock: document namespace mode sysctls

Browse source 
Add documentation for the vsock per-namespace sysctls (`ns_mode` and
`child_ns_mode`) to Documentation/admin-guide/sysctl/net.rst.
These sysctls were introduced by commit eafb64f40c ("vsock: add
netns to vsock core").

Document the two namespace modes (`global` and `local`), the
inheritance behavior of `child_ns_mode`, and the restriction preventing
local namespaces from setting `child_ns_mode` to `global`.

Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Tested-by: Randy Dunlap <rdunlap@infradead.org>
Acked-by: Randy Dunlap <rdunlap@infradead.org>
Link: https://patch.msgid.link/20260216163147.236844-1-sgarzare@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Stefano Garzarella 2026-02-16 17:31:47 +01:00 • committed by Jakub Kicinski
parent ffe68c3766
commit a07c33c6f2
1 changed files with 50 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

52
Documentation/admin-guide/sysctl/net.rst
View file

@ -40,8 +40,8 @@ Table : Subdirectories in /proc/sys/net
bridge Bridging rose X.25 PLP layer
core General parameter tipc TIPC
ethernet Ethernet protocol unix Unix domain sockets
ipv4 IP version 4 x25 X.25 protocol
ipv6 IP version 6
ipv4 IP version 4 vsock VSOCK sockets
ipv6 IP version 6 x25 X.25 protocol
========= =================== = ========== ===================
1. /proc/sys/net/core - Network core options
@ -551,3 +551,51 @@ originally may have been issued in the correct sequential order.
If named_timeout is nonzero, failed topology updates will be placed on a defer
queue until another event arrives that clears the error, or until the timeout
expires. Value is in milliseconds.
6. /proc/sys/net/vsock - VSOCK sockets
--------------------------------------
VSOCK sockets (AF_VSOCK) provide communication between virtual machines and
their hosts. The behavior of VSOCK sockets in a network namespace is determined
by the namespace's mode (``global`` or ``local``), which controls how CIDs
(Context IDs) are allocated and how sockets interact across namespaces.
ns_mode
-------
Read-only. Reports the current namespace's mode, set at namespace creation
and immutable thereafter.
Values:
- ``global`` - the namespace shares system-wide CID allocation and
its sockets can reach any VM or socket in any global namespace.
Sockets in this namespace cannot reach sockets in local
namespaces.
- ``local`` - the namespace has private CID allocation and its
sockets can only connect to VMs or sockets within the same
namespace.
The init_net mode is always ``global``.
child_ns_mode
-------------
Controls what mode newly created child namespaces will inherit. At namespace
creation, ``ns_mode`` is inherited from the parent's ``child_ns_mode``. The
initial value matches the namespace's own ``ns_mode``.
Values:
- ``global`` - child namespaces will share system-wide CID allocation
and their sockets will be able to reach any VM or socket in any
global namespace.
- ``local`` - child namespaces will have private CID allocation and
their sockets will only be able to connect within their own
namespace.
Changing ``child_ns_mode`` only affects namespaces created after the change;
it does not modify the current namespace or any existing children.
A namespace with ``ns_mode`` set to ``local`` cannot change
``child_ns_mode`` to ``global`` (returns ``-EPERM``).