nftables set/map operations failing in user namespace with Linux 7.1.6

nftables set/map operations failing in user namespace with Linux 7.1.6

[Julius Rüberg]

[-- Attachment #1: Type: text/plain, Size: 1377 bytes --]

Hi everyone,

I'm reaching out because I'm encountering an issue with nftables using set/map
operations (e.g., ip6 daddr set ip6 daddr map @forwardmap) inside user namespaces,
introduced somewhere between Linux 7.0.12 and 7.1.3.
I don't encounter the issue on the LTS Kernel (6.18.43).

If this is now intentionally restricted,
could you provide me with a workaround on kernels >= 7.1.3?

Context:
We (the kira-rust project) use nftables in the forwarding plane,
and rely on unshare to run our network emulation in isolated namespaces
as unprivileged user.


System Info:
- Distro: Arch Linux
- Kernel I tested:
  * 6.18.43-1-lts: succeeds
  * 7.0.12-arch1-1: succeeds
  * 7.1.3-arch2-2: fails
  * 7.1.5-arch1-2: fails
  * 7.1.6-arch1-1: fails
- nftables: v1.1.6
- Architecture: x86_64


Minimal Reproducible Example:
$ cat <<EOF | unshare -u -n --map-root user nft -f -
table ip6 foo {
    map forwardmap {
        type ipv6_addr : ipv6_addr
    }
    chain forward {
        ip6 daddr set ip6 daddr map @forwardmap
    }
}
EOF

Experienced Error:
/dev/stdin:6:9-17: Error: Could not process rule: Operation not permitted
        ip6 daddr set ip6 daddr map @forwardmap
        ^^^^^^^^^

Sincerely,


Julius Rüberg


kira-rust: https://gitlab.kit.edu/kit/tm/telematics/kira/kira-rust
KIRA project: https://s.kit.edu/kira

[-- Attachment #2: smime.p7s --]
[-- Type: application/pkcs7-signature, Size: 6267 bytes --]

Re: nftables set/map operations failing in user namespace with Linux 7.1.6

[Florian Westphal]

Julius Rüberg <julius.rueberg@student.kit.edu> wrote:
> I'm reaching out because I'm encountering an issue with nftables using set/map
> operations (e.g., ip6 daddr set ip6 daddr map @forwardmap) inside user namespaces,
> introduced somewhere between Linux 7.0.12 and 7.1.3.
> I don't encounter the issue on the LTS Kernel (6.18.43).
> 
> If this is now intentionally restricted,

Yes:

commit 968cc2c96390f06e56ed6a43f935bfebdefed28f
Author: Florian Westphal <fw@strlen.de>
Date:   Sat May 16 23:23:21 2026 +0800

    netfilter: disable payload mangling in userns

We should be able to lift that restriction in the coming weeks,
after stricter offset/length validation is in place.