mirror of
https://github.com/systemd/systemd.git
synced 2026-11-07 22:07:14 +00:00
totoro
c3c9e7f14d
A newly created network namespace may disallow ICMP echo sockets for unprivileged users even when their GIDs are mapped into the container. When creating both user and network namespaces, initialize net.ipv4.ping_group_range using the mapped GID range capped at INT32_MAX. This follows the system-wide default from sysctl.d/50-default.conf while respecting the user namespace mapping and the kernel's accepted limit. Leave externally supplied network namespaces untouched and treat write failures as non-fatal warnings. Add regression coverage for the default 64K mapped range using the tools already available in the minimal container image. Fixes #41603 (cherry picked from commit2fa149f2c4) (cherry picked from commit1792f7e1c7) (cherry picked from commit8fb64c6724) (cherry picked from commit833156d187)