| From 74a1770e3cb55743240fedfbb5bf04949e336f20 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Wed, 15 Oct 2025 22:15:43 +0200 |
| Subject: rtnetlink: Allow deleting FDB entries in user namespace |
| MIME-Version: 1.0 |
| Content-Type: text/plain; charset=UTF-8 |
| Content-Transfer-Encoding: 8bit |
| |
| From: Johannes Wiesböck <johannes.wiesboeck@aisec.fraunhofer.de> |
| |
| [ Upstream commit bf29555f5bdc017bac22ca66fcb6c9f46ec8788f ] |
| |
| Creating FDB entries is possible from a non-initial user namespace when |
| having CAP_NET_ADMIN, yet, when deleting FDB entries, processes receive |
| an EPERM because the capability is always checked against the initial |
| user namespace. This restricts the FDB management from unprivileged |
| containers. |
| |
| Drop the netlink_capable check in rtnl_fdb_del as it was originally |
| dropped in c5c351088ae7 and reintroduced in 1690be63a27b without |
| intention. |
| |
| This patch was tested using a container on GyroidOS, where it was |
| possible to delete FDB entries from an unprivileged user namespace and |
| private network namespace. |
| |
| Fixes: 1690be63a27b ("bridge: Add vlan support to static neighbors") |
| Reviewed-by: Michael Weiß <michael.weiss@aisec.fraunhofer.de> |
| Tested-by: Harshal Gohel <hg@simonwunderlich.de> |
| Signed-off-by: Johannes Wiesböck <johannes.wiesboeck@aisec.fraunhofer.de> |
| Reviewed-by: Ido Schimmel <idosch@nvidia.com> |
| Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org> |
| Link: https://patch.msgid.link/20251015201548.319871-1-johannes.wiesboeck@aisec.fraunhofer.de |
| Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| net/core/rtnetlink.c | 3 --- |
| 1 file changed, 3 deletions(-) |
| |
| diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c |
| index 3d3743ef4f691..342b92afd1219 100644 |
| --- a/net/core/rtnetlink.c |
| +++ b/net/core/rtnetlink.c |
| @@ -3836,9 +3836,6 @@ static int rtnl_fdb_del(struct sk_buff *skb, struct nlmsghdr *nlh, |
| int err; |
| u16 vid; |
| |
| - if (!netlink_capable(skb, CAP_NET_ADMIN)) |
| - return -EPERM; |
| - |
| if (!del_bulk) { |
| err = nlmsg_parse_deprecated(nlh, sizeof(*ndm), tb, NDA_MAX, |
| NULL, extack); |
| -- |
| 2.51.0 |
| |
