Re: [PATCH net-next 01/15] netfilter: disable br_netfilter in user namespaces

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Mon, Oct 19, 2026 at 01:21:20AM +0000, netdev-bot+sashiko@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential
> issue(s) to consider.
> 
> Critical: 0 · High: 0 · Medium: 1 · Low: 0
> 
> If you believe none of the issues are legitimate, please reply to each
> issue of Medium severity or higher and explain why the AI is wrong.
> If any of them are legitimate and you plan to respin, please let patchwork
> know by including "pw-bot: cr" as a separate line at the end of your reply
> (one such reply per series is enough).
> 
> - [Medium] tools/testing/selftests/net/netfilter/br_netfilter_queue.sh
>   re-execs itself under `unshare -n` (line 40) and then runs `sysctl…
> 
> --
> 
> netfilter: disable br_netfilter in user namespaces
> 
> This commit disables br_netfilter in network namespaces that are not
> owned by init_user_ns. In those namespaces it skips registration of the
> bridge-nf sysctls and of the br_netfilter hooks. It also adds a boot-time
> warning that the module is slated for removal in 2027, and updates the
> bridge documentation to match.
> 
> > diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c
> > index 0a394e5f43916..e15355ff215a7 100644
> > --- a/net/bridge/br_netfilter_hooks.c
> > +++ b/net/bridge/br_netfilter_hooks.c
> 
> [ ... ]
> 
> >  static int __net_init brnf_init_net(struct net *net)
> >  {
> > +	if (net->user_ns != &init_user_ns) {
> > +		struct brnf_net *brnet = net_generic(net, brnf_net_id);
> > +
> > +		brnet->in_userns = true;
> > +		pr_warn_once("br_netfilter no longer supported in user namespaces\n");
> > +		return 0;
> > +	}
> > +
> >  	return br_netfilter_sysctl_init_net(net);
> >  }
> 
> [Severity: Medium]
> Should tools/testing/selftests/net/netfilter/br_netfilter_queue.sh be
> updated along with this change?
> 
> That script re-execs itself in a new netns via unshare -n. The new netns
> inherits the caller's user namespace:
> 
>     [ "${1}" != "run" ] && { unshare -n "${0}" run; exit $?; }
> 
> It then treats a missing sysctl as a hard failure:
> 
>     modprobe -q br_netfilter
> 
>     sysctl net.bridge.bridge-nf-call-iptables=1 || exit 1
> 
> Suppose the selftests run inside a non-initial user namespace, for
> example a rootless container or a CI job under unshare -r.

This patch is disabling br_netfilter for userns, so it is normal to me
that such script run under these assumptions do not work anymore.