rtnetlink: add missing netlink_ns_capable() check for peer netns

rtnl_newlink() lacks a CAP_NET_ADMIN capability check on the peer
network namespace when creating paired devices (veth, vxcan,
netkit). This allows an unprivileged user with a user namespace
to create interfaces in arbitrary network namespaces, including
init_net.

Add a netlink_ns_capable() check for CAP_NET_ADMIN in the peer
namespace before allowing device creation to proceed.

Fixes: 81adee47dfb6 ("net: Support specifying the network namespace upon device creation.")
Signed-off-by: Nikolaos Gkarlis <nickgarlis@gmail.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20260402181432.4126920-1-nickgarlis@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index fae8034efbff0a39ecebcfad7ddd805f0e912865..69daba3ddaf06b0ce42703a7dfbf668accf9a109 100644 (file)
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -3894,28 +3894,42 @@ out_unregister:
        goto out;
 }
 
-static struct net *rtnl_get_peer_net(const struct rtnl_link_ops *ops,
+static struct net *rtnl_get_peer_net(struct sk_buff *skb,
+                                    const struct rtnl_link_ops *ops,
                                     struct nlattr *tbp[],
                                     struct nlattr *data[],
                                     struct netlink_ext_ack *extack)
 {
-       struct nlattr *tb[IFLA_MAX + 1];
+       struct nlattr *tb[IFLA_MAX + 1], **attrs;
+       struct net *net;
        int err;
 
-       if (!data || !data[ops->peer_type])
-               return rtnl_link_get_net_ifla(tbp);
-
-       err = rtnl_nla_parse_ifinfomsg(tb, data[ops->peer_type], extack);
-       if (err < 0)
-               return ERR_PTR(err);
-
-       if (ops->validate) {
-               err = ops->validate(tb, NULL, extack);
+       if (!data || !data[ops->peer_type]) {
+               attrs = tbp;
+       } else {
+               err = rtnl_nla_parse_ifinfomsg(tb, data[ops->peer_type], extack);
                if (err < 0)
                        return ERR_PTR(err);
+
+               if (ops->validate) {
+                       err = ops->validate(tb, NULL, extack);
+                       if (err < 0)
+                               return ERR_PTR(err);
+               }
+
+               attrs = tb;
        }
 
-       return rtnl_link_get_net_ifla(tb);
+       net = rtnl_link_get_net_ifla(attrs);
+       if (IS_ERR_OR_NULL(net))
+               return net;
+
+       if (!netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN)) {
+               put_net(net);
+               return ERR_PTR(-EPERM);
+       }
+
+       return net;
 }
 
 static int __rtnl_newlink(struct sk_buff *skb, struct nlmsghdr *nlh,
@@ -4054,7 +4068,7 @@ static int rtnl_newlink(struct sk_buff *skb, struct nlmsghdr *nlh,
                }
 
                if (ops->peer_type) {
-                       peer_net = rtnl_get_peer_net(ops, tb, data, extack);
+                       peer_net = rtnl_get_peer_net(skb, ops, tb, data, extack);
                        if (IS_ERR(peer_net)) {
                                ret = PTR_ERR(peer_net);
                                goto put_ops;