userns packet mangling

userns packet mangling

[Richard Van Tassel]

Hello, netfilter world.

I am very curious about the status of re-enabling packet mangling in
user namespaces.

I understand that it takes time to find and address security concerns,
and I hope the netfilter community takes all the time they need. That
being said, I just wanted to echo the appetite for that functionality
to return, similar to
582d218b638be68342dd80893c41746b35c1be76.camel@student.kit.edu (sorry
if I'm linking this incorrectly, I haven't used this sort of mailing
list before)

I am currently working around the disabling in a somewhat controlled
fashion using a custom kernel patch and module to allow a process in
init ns with CAP_NET_ADMIN to grant permission to mangle on a per-ns
basis. As I understand the situation currently, I don't think there's
much appetite for accepting this workaround as a kernel contribution,
since the disabling is meant to be temporary. But I feel like I should
mention it nevertheless.

Re: userns packet mangling

[Florian Westphal]

Richard Van Tassel <richard.van.tassel.work@gmail.com> wrote:
> Hello, netfilter world.
> 
> I am very curious about the status of re-enabling packet mangling in
> user namespaces.
> 
> I understand that it takes time to find and address security concerns,
> and I hope the netfilter community takes all the time they need. That
> being said, I just wanted to echo the appetite for that functionality
> to return, similar to
> 582d218b638be68342dd80893c41746b35c1be76.camel@student.kit.edu (sorry
> if I'm linking this incorrectly, I haven't used this sort of mailing
> list before)
 
> I am currently working around the disabling in a somewhat controlled
> fashion using a custom kernel patch and module to allow a process in
> init ns with CAP_NET_ADMIN to grant permission to mangle on a per-ns
> basis. As I understand the situation currently, I don't think there's
> much appetite for accepting this workaround as a kernel contribution,
> since the disabling is meant to be temporary. But I feel like I should
> mention it nevertheless.

https://patchwork.ozlabs.org/project/netfilter-devel/patch/20260905050150.30273-1-fw@strlen.de/

is still pending, and its closing known security hole.
So no, for now we can't re-enable this feature.