| 1 | ================================
|
| 2 | Documentation for /proc/sys/net/
|
| 3 | ================================
|
| 4 |
|
| 5 | Copyright
|
| 6 |
|
| 7 | Copyright (c) 1999
|
| 8 |
|
| 9 | - Terrehon Bowden <[email protected]>
|
| 10 | - Bodo Bauer <[email protected]>
|
| 11 |
|
| 12 | Copyright (c) 2000
|
| 13 |
|
| 14 | - Jorge Nerin <[email protected]>
|
| 15 |
|
| 16 | Copyright (c) 2009
|
| 17 |
|
| 18 | - Shen Feng <[email protected]>
|
| 19 |
|
| 20 | For general info and legal blurb, please look in index.rst.
|
| 21 |
|
| 22 | ------------------------------------------------------------------------------
|
| 23 |
|
| 24 | This file contains the documentation for the sysctl files in
|
| 25 | /proc/sys/net
|
| 26 |
|
| 27 | The interface to the networking parts of the kernel is located in
|
| 28 | /proc/sys/net. The following table shows all possible subdirectories. You may
|
| 29 | see only some of them, depending on your kernel's configuration.
|
| 30 |
|
| 31 |
|
| 32 | Table : Subdirectories in /proc/sys/net
|
| 33 |
|
| 34 | ========= =================== = ========== ===================
|
| 35 | Directory Content Directory Content
|
| 36 | ========= =================== = ========== ===================
|
| 37 | 802 E802 protocol mptcp Multipath TCP
|
| 38 | appletalk Appletalk protocol netfilter Network Filter
|
| 39 | bridge Bridging tipc TIPC
|
| 40 | core General parameter unix Unix domain sockets
|
| 41 | ethernet Ethernet protocol vsock VSOCK sockets
|
| 42 | ipv4 IP version 4 x25 X.25 protocol
|
| 43 | ipv6 IP version 6
|
| 44 | ========= =================== = ========== ===================
|
| 45 |
|
| 46 | 1. /proc/sys/net/core - Network core options
|
| 47 | ============================================
|
| 48 |
|
| 49 | bpf_jit_enable
|
| 50 | --------------
|
| 51 |
|
| 52 | This enables the BPF Just in Time (JIT) compiler. BPF is a flexible
|
| 53 | and efficient infrastructure allowing to execute bytecode at various
|
| 54 | hook points. It is used in a number of Linux kernel subsystems such
|
| 55 | as networking (e.g. XDP, tc), tracing (e.g. kprobes, uprobes, tracepoints)
|
| 56 | and security (e.g. seccomp). LLVM has a BPF back end that can compile
|
| 57 | restricted C into a sequence of BPF instructions. After program load
|
| 58 | through bpf(2) and passing a verifier in the kernel, a JIT will then
|
| 59 | translate these BPF proglets into native CPU instructions. There are
|
| 60 | two flavors of JITs, the newer eBPF JIT currently supported on:
|
| 61 |
|
| 62 | - x86_64
|
| 63 | - x86_32
|
| 64 | - arm64
|
| 65 | - arm32
|
| 66 | - ppc64
|
| 67 | - ppc32
|
| 68 | - sparc64
|
| 69 | - mips64
|
| 70 | - s390x
|
| 71 | - riscv64
|
| 72 | - riscv32
|
| 73 | - loongarch64
|
| 74 | - arc
|
| 75 |
|
| 76 | And the older cBPF JIT supported on the following archs:
|
| 77 |
|
| 78 | - mips
|
| 79 | - sparc
|
| 80 |
|
| 81 | eBPF JITs are a superset of cBPF JITs, meaning the kernel will
|
| 82 | migrate cBPF instructions into eBPF instructions and then JIT
|
| 83 | compile them transparently. Older cBPF JITs can only translate
|
| 84 | tcpdump filters, seccomp rules, etc, but not mentioned eBPF
|
| 85 | programs loaded through bpf(2).
|
| 86 |
|
| 87 | Values:
|
| 88 |
|
| 89 | - 0 - disable the JIT (default value)
|
| 90 | - 1 - enable the JIT
|
| 91 | - 2 - enable the JIT and ask the compiler to emit traces on kernel log.
|
| 92 |
|
| 93 | bpf_jit_harden
|
| 94 | --------------
|
| 95 |
|
| 96 | This enables hardening for the BPF JIT compiler. Supported are eBPF
|
| 97 | JIT backends. Enabling hardening trades off performance, but can
|
| 98 | mitigate JIT spraying.
|
| 99 |
|
| 100 | Values:
|
| 101 |
|
| 102 | - 0 - disable JIT hardening (default value)
|
| 103 | - 1 - enable JIT hardening for unprivileged users only
|
| 104 | - 2 - enable JIT hardening for all users
|
| 105 |
|
| 106 | where "privileged user" in this context means a process having
|
| 107 | CAP_BPF or CAP_SYS_ADMIN in the root user name space.
|
| 108 |
|
| 109 | bpf_jit_kallsyms
|
| 110 | ----------------
|
| 111 |
|
| 112 | When BPF JIT compiler is enabled, then compiled images are unknown
|
| 113 | addresses to the kernel, meaning they neither show up in traces nor
|
| 114 | in /proc/kallsyms. This enables export of these addresses, which can
|
| 115 | be used for debugging/tracing. If bpf_jit_harden is enabled, this
|
| 116 | feature is disabled.
|
| 117 |
|
| 118 | Values :
|
| 119 |
|
| 120 | - 0 - disable JIT kallsyms export (default value)
|
| 121 | - 1 - enable JIT kallsyms export for privileged users only
|
| 122 |
|
| 123 | bpf_jit_limit
|
| 124 | -------------
|
| 125 |
|
| 126 | This enforces a global limit for memory allocations to the BPF JIT
|
| 127 | compiler in order to reject unprivileged JIT requests once it has
|
| 128 | been surpassed. bpf_jit_limit contains the value of the global limit
|
| 129 | in bytes.
|
| 130 |
|
| 131 | dev_weight
|
| 132 | ----------
|
| 133 |
|
| 134 | The maximum number of packets that kernel can handle on a NAPI interrupt,
|
| 135 | it's a Per-CPU variable. For drivers that support LRO or GRO_HW, a hardware
|
| 136 | aggregated packet is counted as one packet in this context.
|
| 137 |
|
| 138 | Default: 64
|
| 139 |
|
| 140 | dev_weight_rx_bias
|
| 141 | ------------------
|
| 142 |
|
| 143 | RPS (e.g. RFS, aRFS) processing is competing with the registered NAPI poll function
|
| 144 | of the driver for the per softirq cycle netdev_budget. This parameter influences
|
| 145 | the proportion of the configured netdev_budget that is spent on RPS based packet
|
| 146 | processing during RX softirq cycles. It is further meant for making current
|
| 147 | dev_weight adaptable for asymmetric CPU needs on RX/TX side of the network stack.
|
| 148 | (see dev_weight_tx_bias) It is effective on a per CPU basis. Determination is based
|
| 149 | on dev_weight and is calculated multiplicative (dev_weight * dev_weight_rx_bias).
|
| 150 |
|
| 151 | Default: 1
|
| 152 |
|
| 153 | dev_weight_tx_bias
|
| 154 | ------------------
|
| 155 |
|
| 156 | Scales the maximum number of packets that can be processed during a TX softirq cycle.
|
| 157 | Effective on a per CPU basis. Allows scaling of current dev_weight for asymmetric
|
| 158 | net stack processing needs. Be careful to avoid making TX softirq processing a CPU hog.
|
| 159 |
|
| 160 | Calculation is based on dev_weight (dev_weight * dev_weight_tx_bias).
|
| 161 |
|
| 162 | Default: 1
|
| 163 |
|
| 164 | default_qdisc
|
| 165 | -------------
|
| 166 |
|
| 167 | The default queuing discipline to use for network devices. This allows
|
| 168 | overriding the default of pfifo_fast with an alternative. Since the default
|
| 169 | queuing discipline is created without additional parameters so is best suited
|
| 170 | to queuing disciplines that work well without configuration like stochastic
|
| 171 | fair queue (sfq), CoDel (codel) or fair queue CoDel (fq_codel). Don't use
|
| 172 | queuing disciplines like Hierarchical Token Bucket or Deficit Round Robin
|
| 173 | which require setting up classes and bandwidths. Note that physical multiqueue
|
| 174 | interfaces still use mq as root qdisc, which in turn uses this default for its
|
| 175 | leaves. Virtual devices (like e.g. lo or veth) ignore this setting and instead
|
| 176 | default to noqueue.
|
| 177 |
|
| 178 | Default: pfifo_fast
|
| 179 |
|
| 180 | busy_read
|
| 181 | ---------
|
| 182 |
|
| 183 | Low latency busy poll timeout for socket reads. (needs CONFIG_NET_RX_BUSY_POLL)
|
| 184 | Approximate time in us to busy loop waiting for packets on the device queue.
|
| 185 | This sets the default value of the SO_BUSY_POLL socket option.
|
| 186 | Can be set or overridden per socket by setting socket option SO_BUSY_POLL,
|
| 187 | which is the preferred method of enabling. If you need to enable the feature
|
| 188 | globally via sysctl, a value of 50 is recommended.
|
| 189 |
|
| 190 | Will increase power usage.
|
| 191 |
|
| 192 | Default: 0 (off)
|
| 193 |
|
| 194 | busy_poll
|
| 195 | ----------------
|
| 196 | Low latency busy poll timeout for poll and select. (needs CONFIG_NET_RX_BUSY_POLL)
|
| 197 | Approximate time in us to busy loop waiting for events.
|
| 198 | Recommended value depends on the number of sockets you poll on.
|
| 199 | For several sockets 50, for several hundreds 100.
|
| 200 | For more than that you probably want to use epoll.
|
| 201 | Note that only sockets with SO_BUSY_POLL set will be busy polled,
|
| 202 | so you want to either selectively set SO_BUSY_POLL on those sockets or set
|
| 203 | sysctl.net.busy_read globally.
|
| 204 |
|
| 205 | Will increase power usage.
|
| 206 |
|
| 207 | Default: 0 (off)
|
| 208 |
|
| 209 | mem_pcpu_rsv
|
| 210 | ------------
|
| 211 |
|
| 212 | Per-cpu reserved forward alloc cache size in page units. Default 1MB per CPU.
|
| 213 |
|
| 214 | bypass_prot_mem
|
| 215 | ---------------
|
| 216 |
|
| 217 | Skip charging socket buffers to the global per-protocol memory
|
| 218 | accounting controlled by net.ipv4.tcp_mem, net.ipv4.udp_mem, etc.
|
| 219 |
|
| 220 | Default: 0 (off)
|
| 221 |
|
| 222 | rmem_default
|
| 223 | ------------
|
| 224 |
|
| 225 | The default setting of the socket receive buffer in bytes.
|
| 226 |
|
| 227 | rmem_max
|
| 228 | --------
|
| 229 |
|
| 230 | The maximum receive socket buffer size in bytes.
|
| 231 |
|
| 232 | Default: 4194304
|
| 233 |
|
| 234 | rps_default_mask
|
| 235 | ----------------
|
| 236 |
|
| 237 | The default RPS CPU mask used on newly created network devices. An empty
|
| 238 | mask means RPS disabled by default.
|
| 239 |
|
| 240 | tstamp_allow_data
|
| 241 | -----------------
|
| 242 | Allow processes to receive tx timestamps looped together with the original
|
| 243 | packet contents. If disabled, transmit timestamp requests from unprivileged
|
| 244 | processes are dropped unless socket option SOF_TIMESTAMPING_OPT_TSONLY is set.
|
| 245 |
|
| 246 | Default: 1 (on)
|
| 247 |
|
| 248 |
|
| 249 | wmem_default
|
| 250 | ------------
|
| 251 |
|
| 252 | The default setting (in bytes) of the socket send buffer.
|
| 253 |
|
| 254 | wmem_max
|
| 255 | --------
|
| 256 |
|
| 257 | The maximum send socket buffer size in bytes.
|
| 258 |
|
| 259 | Default: 4194304
|
| 260 |
|
| 261 | message_burst and message_cost
|
| 262 | ------------------------------
|
| 263 |
|
| 264 | These parameters are used to limit the warning messages written to the kernel
|
| 265 | log from the networking code. They enforce a rate limit to make a
|
| 266 | denial-of-service attack impossible. A higher message_cost factor, results in
|
| 267 | fewer messages that will be written. Message_burst controls when messages will
|
| 268 | be dropped. The default settings limit warning messages to one every five
|
| 269 | seconds.
|
| 270 |
|
| 271 | warnings
|
| 272 | --------
|
| 273 |
|
| 274 | This sysctl is now unused.
|
| 275 |
|
| 276 | This was used to control console messages from the networking stack that
|
| 277 | occur because of problems on the network like duplicate address or bad
|
| 278 | checksums.
|
| 279 |
|
| 280 | These messages are now emitted at KERN_DEBUG and can generally be enabled
|
| 281 | and controlled by the dynamic_debug facility.
|
| 282 |
|
| 283 | netdev_budget
|
| 284 | -------------
|
| 285 |
|
| 286 | Maximum number of packets taken from all interfaces in one polling cycle (NAPI
|
| 287 | poll). In one polling cycle interfaces which are registered to polling are
|
| 288 | probed in a round-robin manner. Also, a polling cycle may not exceed
|
| 289 | netdev_budget_usecs microseconds, even if netdev_budget has not been
|
| 290 | exhausted.
|
| 291 |
|
| 292 | netdev_budget_usecs
|
| 293 | ---------------------
|
| 294 |
|
| 295 | Maximum number of microseconds in one NAPI polling cycle. Polling
|
| 296 | will exit when either netdev_budget_usecs have elapsed during the
|
| 297 | poll cycle or the number of packets processed reaches netdev_budget.
|
| 298 |
|
| 299 | netdev_max_backlog
|
| 300 | ------------------
|
| 301 |
|
| 302 | Maximum number of packets, queued on the INPUT side, when the interface
|
| 303 | receives packets faster than kernel can process them.
|
| 304 |
|
| 305 | qdisc_max_burst
|
| 306 | ------------------
|
| 307 |
|
| 308 | Maximum number of packets that can be temporarily stored before
|
| 309 | reaching qdisc.
|
| 310 |
|
| 311 | Default: 1000
|
| 312 |
|
| 313 | netdev_rss_key
|
| 314 | --------------
|
| 315 |
|
| 316 | RSS (Receive Side Scaling) enabled drivers use a host key that
|
| 317 | is randomly generated.
|
| 318 | Some user space might need to gather its content even if drivers do not
|
| 319 | provide ethtool -x support yet.
|
| 320 |
|
| 321 | ::
|
| 322 |
|
| 323 | myhost:~# cat /proc/sys/net/core/netdev_rss_key
|
| 324 | 84:50:f4:00:a8:15:d1:a7:e9:7f:1d:60:35:c7:47:25:42:97:74:ca:56:bb:b6:a1:d8: ... (256 bytes total)
|
| 325 |
|
| 326 | File contains all nul bytes if no driver ever called netdev_rss_key_fill()
|
| 327 | function.
|
| 328 |
|
| 329 | Note:
|
| 330 | /proc/sys/net/core/netdev_rss_key contains 256 bytes of key,
|
| 331 | but many drivers only use 40 or 52 bytes of it.
|
| 332 |
|
| 333 | ::
|
| 334 |
|
| 335 | myhost:~# ethtool -x eth0
|
| 336 | RX flow hash indirection table for eth0 with 8 RX ring(s):
|
| 337 | 0: 0 1 2 3 4 5 6 7
|
| 338 | RSS hash key:
|
| 339 | 84:50:f4:00:a8:15:d1:a7:e9:7f:1d:60:35:c7:47:25:42:97:74:ca:56:bb:b6:a1:d8:43:e3:c9:0c:fd:17:55:c2:3a:4d:69:ed:f1:42:89
|
| 340 |
|
| 341 | netdev_tstamp_prequeue
|
| 342 | ----------------------
|
| 343 |
|
| 344 | If set to 0, RX packet timestamps can be sampled after RPS processing, when
|
| 345 | the target CPU processes packets. It might give some delay on timestamps, but
|
| 346 | permit to distribute the load on several cpus.
|
| 347 |
|
| 348 | If set to 1 (default), timestamps are sampled as soon as possible, before
|
| 349 | queueing.
|
| 350 |
|
| 351 | netdev_unregister_timeout_secs
|
| 352 | ------------------------------
|
| 353 |
|
| 354 | Unregister network device timeout in seconds.
|
| 355 | This option controls the timeout (in seconds) used to issue a warning while
|
| 356 | waiting for a network device refcount to drop to 0 during device
|
| 357 | unregistration. A lower value may be useful during bisection to detect
|
| 358 | a leaked reference faster. A larger value may be useful to prevent false
|
| 359 | warnings on slow/loaded systems.
|
| 360 | Default value is 10, minimum 1, maximum 3600.
|
| 361 |
|
| 362 | skb_defer_max
|
| 363 | -------------
|
| 364 |
|
| 365 | Max size (in skbs) of the per-cpu list of skbs being freed
|
| 366 | by the cpu which allocated them.
|
| 367 |
|
| 368 | Default: 128
|
| 369 |
|
| 370 | optmem_max
|
| 371 | ----------
|
| 372 |
|
| 373 | Maximum ancillary buffer size allowed per socket. Ancillary data is a sequence
|
| 374 | of struct cmsghdr structures with appended data. TCP tx zerocopy also uses
|
| 375 | optmem_max as a limit for its internal structures.
|
| 376 |
|
| 377 | Default : 128 KB
|
| 378 |
|
| 379 | fb_tunnels_only_for_init_net
|
| 380 | ----------------------------
|
| 381 |
|
| 382 | Controls if fallback tunnels (like tunl0, gre0, gretap0, erspan0,
|
| 383 | sit0, ip6tnl0, ip6gre0) are automatically created. There are 3 possibilities
|
| 384 | (a) value = 0; respective fallback tunnels are created when module is
|
| 385 | loaded in every net namespaces (backward compatible behavior).
|
| 386 | (b) value = 1; [kcmd value: initns] respective fallback tunnels are
|
| 387 | created only in init net namespace and every other net namespace will
|
| 388 | not have them.
|
| 389 | (c) value = 2; [kcmd value: none] fallback tunnels are not created
|
| 390 | when a module is loaded in any of the net namespace. Setting value to
|
| 391 | "2" is pointless after boot if these modules are built-in, so there is
|
| 392 | a kernel command-line option that can change this default. Please refer to
|
| 393 | Documentation/admin-guide/kernel-parameters.txt for additional details.
|
| 394 |
|
| 395 | Not creating fallback tunnels gives control to userspace to create
|
| 396 | whatever is needed only and avoid creating devices which are redundant.
|
| 397 |
|
| 398 | Default : 0 (for compatibility reasons)
|
| 399 |
|
| 400 | devconf_inherit_init_net
|
| 401 | ------------------------
|
| 402 |
|
| 403 | Controls if a new network namespace should inherit all current
|
| 404 | settings under /proc/sys/net/{ipv4,ipv6}/conf/{all,default}/. By
|
| 405 | default, we keep the current behavior: for IPv4 we inherit all current
|
| 406 | settings from init_net and for IPv6 we reset all settings to default.
|
| 407 |
|
| 408 | If set to 1, both IPv4 and IPv6 settings are forced to inherit from
|
| 409 | current ones in init_net. If set to 2, both IPv4 and IPv6 settings are
|
| 410 | forced to reset to their default values. If set to 3, both IPv4 and IPv6
|
| 411 | settings are forced to inherit from current ones in the netns where this
|
| 412 | new netns has been created.
|
| 413 |
|
| 414 | Default : 0 (for compatibility reasons)
|
| 415 |
|
| 416 | txrehash
|
| 417 | --------
|
| 418 |
|
| 419 | Controls default hash rethink behaviour on socket when SO_TXREHASH option is set
|
| 420 | to SOCK_TXREHASH_DEFAULT (i. e. not overridden by setsockopt).
|
| 421 |
|
| 422 | If set to 1 (default), hash rethink is performed on listening socket.
|
| 423 | If set to 0, hash rethink is not performed.
|
| 424 |
|
| 425 | txq_reselection_ms
|
| 426 | ------------------
|
| 427 |
|
| 428 | Controls how often (in ms) a busy connected flow can select another tx queue.
|
| 429 |
|
| 430 | A resection is desirable when/if user thread has migrated and XPS
|
| 431 | would select a different queue. Same can occur without XPS
|
| 432 | if the flow hash has changed.
|
| 433 |
|
| 434 | But switching txq can introduce reorders, especially if the
|
| 435 | old queue is under high pressure. Modern TCP stacks deal
|
| 436 | well with reorders if they happen not too often.
|
| 437 |
|
| 438 | To disable this feature, set the value to 0.
|
| 439 |
|
| 440 | Default : 1000
|
| 441 |
|
| 442 | gro_normal_batch
|
| 443 | ----------------
|
| 444 |
|
| 445 | Maximum number of the segments to batch up on output of GRO. When a packet
|
| 446 | exits GRO, either as a coalesced superframe or as an original packet which
|
| 447 | GRO has decided not to coalesce, it is placed on a per-NAPI list. This
|
| 448 | list is then passed to the stack when the number of segments reaches the
|
| 449 | gro_normal_batch limit.
|
| 450 |
|
| 451 | high_order_alloc_disable
|
| 452 | ------------------------
|
| 453 |
|
| 454 | By default the allocator for page frags tries to use high order pages (order-3
|
| 455 | on x86). While the default behavior gives good results in most cases, some users
|
| 456 | might have hit a contention in page allocations/freeing. This was especially
|
| 457 | true on older kernels (< 5.14) when high-order pages were not stored on per-cpu
|
| 458 | lists. This allows to opt-in for order-0 allocation instead but is now mostly of
|
| 459 | historical importance.
|
| 460 |
|
| 461 | Default: 0
|
| 462 |
|
| 463 | 2. /proc/sys/net/unix - Parameters for Unix domain sockets
|
| 464 | ----------------------------------------------------------
|
| 465 |
|
| 466 | There is only one file in this directory.
|
| 467 | unix_dgram_qlen limits the max number of datagrams queued in Unix domain
|
| 468 | socket's buffer. It will not take effect unless PF_UNIX flag is specified.
|
| 469 |
|
| 470 |
|
| 471 | 3. /proc/sys/net/ipv4 - IPV4 settings
|
| 472 | -------------------------------------
|
| 473 | Please see: Documentation/networking/ip-sysctl.rst and
|
| 474 | Documentation/admin-guide/sysctl/net.rst for descriptions of these entries.
|
| 475 |
|
| 476 |
|
| 477 | 4. TIPC
|
| 478 | -------
|
| 479 |
|
| 480 | tipc_rmem
|
| 481 | ---------
|
| 482 |
|
| 483 | The TIPC protocol now has a tunable for the receive memory, similar to the
|
| 484 | tcp_rmem - i.e. a vector of 3 INTEGERs: (min, default, max)
|
| 485 |
|
| 486 | ::
|
| 487 |
|
| 488 | # cat /proc/sys/net/tipc/tipc_rmem
|
| 489 | 4252725 34021800 68043600
|
| 490 | #
|
| 491 |
|
| 492 | The max value is set to CONN_OVERLOAD_LIMIT, and the default and min values
|
| 493 | are scaled (shifted) versions of that same value. Note that the min value
|
| 494 | is not at this point in time used in any meaningful way, but the triplet is
|
| 495 | preserved in order to be consistent with things like tcp_rmem.
|
| 496 |
|
| 497 | named_timeout
|
| 498 | -------------
|
| 499 |
|
| 500 | TIPC name table updates are distributed asynchronously in a cluster, without
|
| 501 | any form of transaction handling. This means that different race scenarios are
|
| 502 | possible. One such is that a name withdrawal sent out by one node and received
|
| 503 | by another node may arrive after a second, overlapping name publication already
|
| 504 | has been accepted from a third node, although the conflicting updates
|
| 505 | originally may have been issued in the correct sequential order.
|
| 506 | If named_timeout is nonzero, failed topology updates will be placed on a defer
|
| 507 | queue until another event arrives that clears the error, or until the timeout
|
| 508 | expires. Value is in milliseconds.
|
| 509 |
|
| 510 | 6. /proc/sys/net/vsock - VSOCK sockets
|
| 511 | --------------------------------------
|
| 512 |
|
| 513 | VSOCK sockets (AF_VSOCK) provide communication between virtual machines and
|
| 514 | their hosts. The behavior of VSOCK sockets in a network namespace is determined
|
| 515 | by the namespace's mode (``global`` or ``local``), which controls how CIDs
|
| 516 | (Context IDs) are allocated and how sockets interact across namespaces.
|
| 517 |
|
| 518 | ns_mode
|
| 519 | -------
|
| 520 |
|
| 521 | Read-only. Reports the current namespace's mode, set at namespace creation
|
| 522 | and immutable thereafter.
|
| 523 |
|
| 524 | Values:
|
| 525 |
|
| 526 | - ``global`` - the namespace shares system-wide CID allocation and
|
| 527 | its sockets can reach any VM or socket in any global namespace.
|
| 528 | Sockets in this namespace cannot reach sockets in local
|
| 529 | namespaces.
|
| 530 | - ``local`` - the namespace has private CID allocation and its
|
| 531 | sockets can only connect to VMs or sockets within the same
|
| 532 | namespace.
|
| 533 |
|
| 534 | The init_net mode is always ``global``.
|
| 535 |
|
| 536 | child_ns_mode
|
| 537 | -------------
|
| 538 |
|
| 539 | Controls what mode newly created child namespaces will inherit. At namespace
|
| 540 | creation, ``ns_mode`` is inherited from the parent's ``child_ns_mode``. The
|
| 541 | initial value matches the namespace's own ``ns_mode``.
|
| 542 |
|
| 543 | Values:
|
| 544 |
|
| 545 | - ``global`` - child namespaces will share system-wide CID allocation
|
| 546 | and their sockets will be able to reach any VM or socket in any
|
| 547 | global namespace.
|
| 548 | - ``local`` - child namespaces will have private CID allocation and
|
| 549 | their sockets will only be able to connect within their own
|
| 550 | namespace.
|
| 551 |
|
| 552 | The first write to ``child_ns_mode`` locks its value. Subsequent writes of the
|
| 553 | same value succeed, but writing a different value returns ``-EBUSY``.
|
| 554 |
|
| 555 | Changing ``child_ns_mode`` only affects namespaces created after the change;
|
| 556 | it does not modify the current namespace or any existing children.
|
| 557 |
|
| 558 | A namespace with ``ns_mode`` set to ``local`` cannot change
|
| 559 | ``child_ns_mode`` to ``global`` (returns ``-EPERM``).
|
| 560 |
|
| 561 | g2h_fallback
|
| 562 | ------------
|
| 563 |
|
| 564 | Controls whether connections to CIDs not owned by the host-to-guest (H2G)
|
| 565 | transport automatically fall back to the guest-to-host (G2H) transport.
|
| 566 |
|
| 567 | When enabled, if a connect targets a CID that the H2G transport (e.g.
|
| 568 | vhost-vsock) does not serve, or if no H2G transport is loaded at all, the
|
| 569 | connection is routed via the G2H transport (e.g. virtio-vsock) instead. This
|
| 570 | allows a host running both nested VMs (via vhost-vsock) and sibling VMs
|
| 571 | reachable through the hypervisor (e.g. Nitro Enclaves) to address both using
|
| 572 | a single CID space, without requiring applications to set
|
| 573 | ``VMADDR_FLAG_TO_HOST``.
|
| 574 |
|
| 575 | When the fallback is taken, ``VMADDR_FLAG_TO_HOST`` is automatically set on
|
| 576 | the remote address so that userspace can determine the path via
|
| 577 | ``getpeername()``.
|
| 578 |
|
| 579 | Note: With this sysctl enabled, user space that attempts to talk to a guest
|
| 580 | CID which is not implemented by the H2G transport will create host vsock
|
| 581 | traffic. Environments that rely on H2G-only isolation should set it to 0.
|
| 582 |
|
| 583 | Values:
|
| 584 |
|
| 585 | - 0 - Connections to CIDs <= 2 or with VMADDR_FLAG_TO_HOST use G2H;
|
| 586 | all others use H2G (or fail with ENODEV if H2G is not loaded).
|
| 587 | - 1 - Connections to CIDs not owned by H2G fall back to G2H. (default)
|