kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-22 19:14:51 +00:00
Code Issues Releases Packages Activity
linux/net/core
History
Johannes Wiesböck ada21254a9 rtnetlink: Allow deleting FDB entries in user namespace 
[ Upstream commit bf29555f5b ]

Creating FDB entries is possible from a non-initial user namespace when
having CAP_NET_ADMIN, yet, when deleting FDB entries, processes receive
an EPERM because the capability is always checked against the initial
user namespace. This restricts the FDB management from unprivileged
containers.

Drop the netlink_capable check in rtnl_fdb_del as it was originally
dropped in c5c351088a and reintroduced in 1690be63a2 without
intention.

This patch was tested using a container on GyroidOS, where it was
possible to delete FDB entries from an unprivileged user namespace and
private network namespace.

Fixes: 1690be63a2 ("bridge: Add vlan support to static neighbors")
Reviewed-by: Michael Weiß <michael.weiss@aisec.fraunhofer.de>
Tested-by: Harshal Gohel <hg@simonwunderlich.de>
Signed-off-by: Johannes Wiesböck <johannes.wiesboeck@aisec.fraunhofer.de>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org>
Link: https://patch.msgid.link/20251015201548.319871-1-johannes.wiesboeck@aisec.fraunhofer.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2025-10-29 14:08:53 +01:00
..
bpf_sk_storage.c netlink: introduce type-checking attribute iteration 2024-03-29 15:06:02 -07:00
datagram.c net: add support for skbs with unreadable frags 2024-09-11 20:44:31 -07:00
dev.c net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM 2025-08-28 16:31:14 +02:00
dev.h net: page_pool: avoid false positive warning if NAPI was never added 2025-05-29 11:02:59 +02:00
dev_addr_lists.c net: Correct spelling in net/core 2024-08-26 09:37:23 -07:00
dev_addr_lists_test.c net: dev_addr_lists: move locking out of init/exit in kunit 2024-04-15 10:26:35 +01:00
dev_ioctl.c netdevice: convert private flags > BIT(31) to bitfields 2024-09-03 11:36:43 +02:00
devmem.c net: devmem: do not WARN conditionally after netdev_rx_queue_restart() 2025-04-10 14:39:31 +02:00
devmem.h tcp: RX path for devmem TCP 2024-09-11 20:44:32 -07:00
drop_monitor.c drop_monitor: fix incorrect initialization order 2025-02-27 04:30:21 -08:00
dst.c net: dst: add four helpers to annotate data-races around dst->dev 2025-10-23 16:20:45 +02:00
dst_cache.c net: dst_cache: add two DEBUG_NET warnings 2024-06-03 18:50:09 -07:00
failover.c net: failover: use IFF_NO_ADDRCONF flag to prevent ipv6 addrconf 2022-12-12 15:18:25 -08:00
fib_notifier.c net: fib_notifier: propagate extack down to the notifier block callback 2019-10-04 11:10:56 -07:00
fib_rules.c net: fib_rules: annotate data-races around rule->[io]ifindex 2025-02-21 14:01:16 +01:00
filter.c bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} 2025-10-19 16:33:41 +02:00
flow_dissector.c flow_dissector: Fix port range key handling in BPF conversion 2025-02-27 04:30:18 -08:00
flow_offload.c tc: flower: Enable offload support IPSEC SPI field. 2023-08-02 10:09:32 +01:00
gen_estimator.c net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y 2025-09-09 18:58:07 +02:00
gen_stats.c net: Remove the obsolte u64_stats_fetch_*_irq() users (net). 2022-10-28 20:13:54 -07:00
gro.c net: Clear old fragment checksum value in napi_reuse_skb 2025-03-07 18:25:33 +01:00
gro_cells.c net: move netdev_max_backlog to net_hotdata 2024-03-07 21:12:42 -08:00
gso.c net: introduce struct net_hotdata 2024-03-07 21:12:41 -08:00
hotdata.c net: move sysctl_mem_pcpu_rsv to net_hotdata 2024-04-30 18:46:52 -07:00
hwbm.c net: hwbm: Make the hwbm_pool lock a mutex 2019-06-09 19:40:10 -07:00
ieee8021q_helpers.c net: ieee8021q: fix insufficient table-size assertion 2025-08-20 18:30:34 +02:00
link_watch.c ipvlan: Fix use-after-free in ipvlan_get_iflink(). 2025-01-17 13:40:39 +01:00
lwt_bpf.c bpf: lwtunnel: Unmask upper DSCP bits in bpf_lwt_xmit_reroute() 2024-09-09 14:14:52 +01:00
lwtunnel.c net: lwtunnel: disable BHs when required 2025-05-02 07:59:01 +02:00
Makefile netdev: support binding dma-buf to netdevice 2024-09-11 20:44:31 -07:00
mp_dmabuf_devmem.h memory-provider: dmabuf devmem memory provider 2024-09-11 20:44:31 -07:00
neighbour.c neighbour: add support for NUD_PERMANENT proxy entries 2025-08-20 18:30:37 +02:00
net-procfs.c net: make softnet_data.dropped an atomic_t 2024-04-01 11:28:32 +01:00
net-sysfs.c net: sysfs: Fix weird usage of class's namespace relevant fields 2024-09-09 10:30:52 +01:00
net-sysfs.h net-sysfs: add netdev_change_owner() 2020-02-26 20:07:25 -08:00
net-traces.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
net_namespace.c net: Add net_passive_inc() and net_passive_dec(). 2025-08-20 18:30:56 +02:00
net_test.c pfcp: always set pfcp metadata 2024-04-01 10:49:28 +01:00
netclassid_cgroup.c cgroup, netclassid: on modifying netclassid in cgroup, only consider the main process. 2023-10-16 16:36:53 -07:00
netdev-genl-gen.c netdev: avoid CFI problems with sock priv helpers 2025-01-23 17:22:52 +01:00
netdev-genl-gen.h netdev: support binding dma-buf to netdevice 2024-09-11 20:44:31 -07:00
netdev-genl.c net: export a helper for adding up queue stats 2025-05-18 08:24:50 +02:00
netdev_rx_queue.c memory-provider: dmabuf devmem memory provider 2024-09-11 20:44:31 -07:00
netevent.c net: core: Correct function name netevent_unregister_notifier() in the kerneldoc 2021-03-28 17:56:56 -07:00
netmem_priv.h page_pool: Track DMA-mapped pages and unmap them when destroying the pool 2025-06-19 15:31:42 +02:00
netpoll.c netpoll: prevent hanging NAPI when netcons gets enabled 2025-08-15 12:14:04 +02:00
netprio_cgroup.c bpf, cgroups: Fix cgroup v2 fallback on v1/v2 mixed mode 2021-09-13 16:35:58 -07:00
of_net.c net: Explicitly include correct DT includes 2023-07-27 20:33:16 -07:00
page_pool.c page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches 2025-10-19 16:33:34 +02:00
page_pool_priv.h memory-provider: dmabuf devmem memory provider 2024-09-11 20:44:31 -07:00
page_pool_user.c net: page_pool: don't cast mp param to devmem 2025-04-20 10:15:17 +02:00
pktgen.c net: pktgen: fix access outside of user given buffer in pktgen_thread_write() 2025-05-29 11:02:43 +02:00
ptp_classifier.c ptp: Add generic PTP is_sync() function 2022-03-07 11:31:34 +00:00
request_sock.c tcp: make sure init the accept_queue's spinlocks once 2024-01-19 21:13:25 -08:00
rtnetlink.c rtnetlink: Allow deleting FDB entries in user namespace 2025-10-29 14:08:53 +01:00
scm.c tcp: devmem: don't write truncated dmabuf CMSGs to userspace 2025-03-07 18:25:32 +01:00
secure_seq.c tcp: Fix data-races around sysctl knobs related to SYN option. 2022-07-20 10:14:49 +01:00
selftests.c net: selftests: fix TCP packet checksum 2025-07-06 11:01:41 +02:00
skbuff.c net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS 2025-10-02 13:44:10 +02:00
skmsg.c bpf, sockmap: Fix psock incorrectly pointing to sk 2025-08-15 12:13:39 +02:00
sock.c net: dst: add four helpers to annotate data-races around dst->dev 2025-10-23 16:20:45 +02:00
sock_destructor.h skb_expand_head() adjust skb->truesize incorrectly 2021-10-22 12:35:51 -07:00
sock_diag.c net: use unrcu_pointer() helper 2024-06-06 11:52:52 +02:00
sock_map.c bpf: Disable non stream socket for strparser 2025-02-27 04:30:19 -08:00
sock_reuseport.c net: core: annotate socks of struct sock_reuseport with __counted_by 2024-08-02 17:16:59 -07:00
stream.c net: Return error from sk_stream_wait_connect() if sk_wait_event() fails 2023-12-15 10:48:51 +00:00
sysctl_net_core.c net: set the minimum for net_hotdata.netdev_budget_usecs 2025-03-07 18:25:29 +01:00
timestamping.c net: Change the API of PHY default timestamp to MAC 2024-07-15 08:02:26 -07:00
tso.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
utils.c net: Fix checksum update for ILA adj-transport 2025-06-27 11:11:40 +01:00
xdp.c page_pool: Move pp_magic check into helper functions 2025-06-19 15:31:42 +02:00