From: Jakub Kicinski Date: Wed, 17 Jun 2026 23:03:57 +0000 (-0700) Subject: Merge branch 'net-require-cap_net_admin-in-the-device-netns-for-tunnel-changelink' X-Git-Tag: v7.2-rc1~29^2~113 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=0e80602c026b98ec9f775f8a6a4eaea577733d6b;p=thirdparty%2Flinux.git Merge branch 'net-require-cap_net_admin-in-the-device-netns-for-tunnel-changelink' Maoyi Xie says: ==================== net: require CAP_NET_ADMIN in the device netns for tunnel changelink A tunnel changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in the link netns can rewrite a tunnel that lives in the link netns. Commit 8b484efd5cb4 ("ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().") added the same check on the ioctl path. This series adds it on the RTM_NEWLINK path. Each changelink is gated at the top of the op, before any attribute is parsed, because the per-type parsers can update live tunnel fields first (for example ipgre_netlink_parms() sets t->collect_md). The check is skipped when the link netns is dev_net(dev), where the rtnl path already checked the cap. The check goes through a new helper, rtnl_dev_link_net_capable(), added in patch 1 next to rtnl_get_net_ns_capable() in net/core/rtnetlink.c. Tested on net/main. For every tunnel type in the series a migrated fake-root changelink is rejected with EPERM. For vti6 SIOCGETTUNNEL confirms the link netns hash is left unchanged. Legit non-migrated changelinks still succeed. v5: https://lore.kernel.org/20260611062814.2528793-1-maoyixie.tju@gmail.com v4: https://lore.kernel.org/20260609163110.1717419-1-maoyixie.tju@gmail.com v3: https://lore.kernel.org/20260604125055.3254652-1-maoyixie.tju@gmail.com v2: https://lore.kernel.org/20260601034148.1272080-1-maoyixie.tju@gmail.com v1: https://lore.kernel.org/20260527070824.2677331-1-maoyixie.tju@gmail.com ==================== Link: https://patch.msgid.link/20260612085941.3158249-1-maoyixie.tju@gmail.com Signed-off-by: Jakub Kicinski --- 0e80602c026b98ec9f775f8a6a4eaea577733d6b