linux-kernel - [PATCH] rtnetlink: Allow deleting FDB entries in user namespace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20250923082153.60030-1-johannes.wiesboeck@aisec.fraunhofer.de>
Date: Tue, 23 Sep 2025 10:21:40 +0200
From: Johannes Wiesböck <johannes.wiesboeck@...ec.fraunhofer.de>
To:
CC: <gyroidos@...ec.fraunhofer.de>, <sw@...onwunderlich.de>,
	Johannes Wiesböck
	<johannes.wiesboeck@...ec.fraunhofer.de>, Michael Weiß
	<michael.weiss@...ec.fraunhofer.de>, Harshal Gohel <hg@...onwunderlich.de>,
	"David S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, Simon
 Horman <horms@...nel.org>, Kuniyuki Iwashima <kuniyu@...gle.com>, Stanislav
 Fomichev <sdf@...ichev.me>, Xiao Liang <shaw.leon@...il.com>,
	<netdev@...r.kernel.org>, <linux-kernel@...r.kernel.org>
Subject: [PATCH] rtnetlink: Allow deleting FDB entries in user namespace

Deletion of FDB entries requires CAP_NET_ADMIN, yet, processes in a
non-initial user namespace receive an EPERM because the capability is
always checked against the initial user namespace. This restricts the
FDB management from unprivileged containers.

Replace netlink_capable with netlink_net_capable that performs the
capability check on the user namespace the netlink socket was opened in.

This patch was tested using a container on GyroidOS, where it was
possible to delete FDB entries from an unprivileged user namespace and
private network namespace.

Reviewed-by: Michael Weiß <michael.weiss@...ec.fraunhofer.de>
Tested-by: Harshal Gohel <hg@...onwunderlich.de>
Signed-off-by: Johannes Wiesböck <johannes.wiesboeck@...ec.fraunhofer.de>
---
 net/core/rtnetlink.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 094b085cff206..2f96258bd4fd7 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -4707,7 +4707,7 @@ static int rtnl_fdb_del(struct sk_buff *skb, struct nlmsghdr *nlh,
 	int err;
 	u16 vid;
 
-	if (!netlink_capable(skb, CAP_NET_ADMIN))
+	if (!netlink_net_capable(skb, CAP_NET_ADMIN))
 		return -EPERM;
 
 	if (!del_bulk) {
-- 
2.51.0