linux-kernel - Re: [PATCH net v2] rtnetlink: Allow deleting FDB entries in user namespace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aPCl8EO8xkRVzaQi@shredder>
Date: Thu, 16 Oct 2025 10:59:44 +0300
From: Ido Schimmel <idosch@...sch.org>
To: Johannes Wiesböck <johannes.wiesboeck@...ec.fraunhofer.de>
Cc: "David S. Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
	Simon Horman <horms@...nel.org>,
	Kuniyuki Iwashima <kuniyu@...gle.com>,
	Stanislav Fomichev <sdf@...ichev.me>,
	Xiao Liang <shaw.leon@...il.com>,
	Vlad Yasevich <vyasevic@...hat.com>,
	Jitendra Kalsaria <jitendra.kalsaria@...gic.com>,
	netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
	gyroidos@...ec.fraunhofer.de, sw@...onwunderlich.de,
	Michael Weiß <michael.weiss@...ec.fraunhofer.de>,
	Harshal Gohel <hg@...onwunderlich.de>
Subject: Re: [PATCH net v2] rtnetlink: Allow deleting FDB entries in user
 namespace

On Wed, Oct 15, 2025 at 10:15:43PM +0200, Johannes Wiesböck wrote:
> Creating FDB entries is possible from a non-initial user namespace when
> having CAP_NET_ADMIN, yet, when deleting FDB entries, processes receive
> an EPERM because the capability is always checked against the initial
> user namespace. This restricts the FDB management from unprivileged
> containers.
> 
> Drop the netlink_capable check in rtnl_fdb_del as it was originally
> dropped in c5c351088ae7 and reintroduced in 1690be63a27b without
> intention.
> 
> This patch was tested using a container on GyroidOS, where it was
> possible to delete FDB entries from an unprivileged user namespace and
> private network namespace.
> 
> Fixes: 1690be63a27b ("bridge: Add vlan support to static neighbors")
> Reviewed-by: Michael Weiß <michael.weiss@...ec.fraunhofer.de>
> Tested-by: Harshal Gohel <hg@...onwunderlich.de>
> Signed-off-by: Johannes Wiesböck <johannes.wiesboeck@...ec.fraunhofer.de>

Reviewed-by: Ido Schimmel <idosch@...dia.com>