Re: [PATCH net-next 01/15] netfilter: disable br_netfilter in user namespaces

[netdev-bot+sashiko@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue(s) to consider.

Critical: 0 · High: 0 · Medium: 1 · Low: 0

If you believe none of the issues are legitimate, please reply to each
issue of Medium severity or higher and explain why the AI is wrong.
If any of them are legitimate and you plan to respin, please let patchwork
know by including "pw-bot: cr" as a separate line at the end of your reply
(one such reply per series is enough).

- [Medium] tools/testing/selftests/net/netfilter/br_netfilter_queue.sh
  re-execs itself under `unshare -n` (line 40) and then runs `sysctl…

--

netfilter: disable br_netfilter in user namespaces

This commit disables br_netfilter in network namespaces that are not
owned by init_user_ns. In those namespaces it skips registration of the
bridge-nf sysctls and of the br_netfilter hooks. It also adds a boot-time
warning that the module is slated for removal in 2027, and updates the
bridge documentation to match.

> diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c
> index 0a394e5f43916..e15355ff215a7 100644
> --- a/net/bridge/br_netfilter_hooks.c
> +++ b/net/bridge/br_netfilter_hooks.c

[ ... ]

>  static int __net_init brnf_init_net(struct net *net)
>  {
> +	if (net->user_ns != &init_user_ns) {
> +		struct brnf_net *brnet = net_generic(net, brnf_net_id);
> +
> +		brnet->in_userns = true;
> +		pr_warn_once("br_netfilter no longer supported in user namespaces\n");
> +		return 0;
> +	}
> +
>  	return br_netfilter_sysctl_init_net(net);
>  }

[Severity: Medium]
Should tools/testing/selftests/net/netfilter/br_netfilter_queue.sh be
updated along with this change?

That script re-execs itself in a new netns via unshare -n. The new netns
inherits the caller's user namespace:

    [ "${1}" != "run" ] && { unshare -n "${0}" run; exit $?; }

It then treats a missing sysctl as a hard failure:

    modprobe -q br_netfilter

    sysctl net.bridge.bridge-nf-call-iptables=1 || exit 1

Suppose the selftests run inside a non-initial user namespace, for
example a rootless container or a CI job under unshare -r. Then the
netns created by unshare -n has user_ns != &init_user_ns, and
brnf_init_net() returns before registering the sysctls. The sysctl
write fails and the script exits 1, so the test reports FAIL instead of
SKIP.

Before this patch the sysctl was present and writable by userns root,
so the test passed in that environment.

The sibling test br_netfilter.sh already treats the same condition as a
skip:

    if ! ip netns exec "$ns0" sysctl -q net.bridge.bridge-nf-call-iptables=1; then
    	echo "SKIP: bridge netfilter not available"
    	ret=$ksft_skip
    fi

Could br_netfilter_queue.sh use the same handling and exit with
$ksft_skip here?

-- 
Sashiko AI review · https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20261018005638.1776148-2-pablo%40netfilter.org