[PATCH net v2] rtnetlink: add missing netlink_ns_capable() check for peer netns

[PATCH net v2] rtnetlink: add missing netlink_ns_capable() check for peer netns

[Nikolaos Gkarlis]

rtnl_newlink() lacks a CAP_NET_ADMIN capability check on the peer
network namespace when creating paired devices (veth, vxcan,
netkit). This allows an unprivileged user with a user namespace
to create interfaces in arbitrary network namespaces, including
init_net.

Add a netlink_ns_capable() check for CAP_NET_ADMIN in the peer
namespace before allowing device creation to proceed.

Fixes: 81adee47dfb6 ("net: Support specifying the network namespace upon device creation.")
Signed-off-by: Nikolaos Gkarlis <nickgarlis@gmail.com>
---
v2:
 - Removed "Reported-by" tag
 - Fixed "Fixes" tag with the help of Kuniyuki Iwashima (thanks !)

 net/core/rtnetlink.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index fae8034efbf..ee7d9d65b2c 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -4059,8 +4059,15 @@ static int rtnl_newlink(struct sk_buff *skb, struct nlmsghdr *nlh,
 				ret = PTR_ERR(peer_net);
 				goto put_ops;
 			}
-			if (peer_net)
+			if (peer_net) {
+				if (!netlink_ns_capable(skb, peer_net->user_ns,
+							CAP_NET_ADMIN)) {
+					put_net(peer_net);
+					ret = -EPERM;
+					goto put_ops;
+				}
 				rtnl_nets_add(&rtnl_nets, peer_net);
+			}
 		}
 	}
 
-- 
2.34.1

Re: [PATCH net v2] rtnetlink: add missing netlink_ns_capable() check for peer netns

[Kuniyuki Iwashima]

On Fri, Mar 27, 2026 at 3:12 PM Nikolaos Gkarlis <nickgarlis@gmail.com> wrote:
>
> rtnl_newlink() lacks a CAP_NET_ADMIN capability check on the peer
> network namespace when creating paired devices (veth, vxcan,
> netkit). This allows an unprivileged user with a user namespace
> to create interfaces in arbitrary network namespaces, including
> init_net.
>
> Add a netlink_ns_capable() check for CAP_NET_ADMIN in the peer
> namespace before allowing device creation to proceed.
>
> Fixes: 81adee47dfb6 ("net: Support specifying the network namespace upon device creation.")
> Signed-off-by: Nikolaos Gkarlis <nickgarlis@gmail.com>
> ---
> v2:
>  - Removed "Reported-by" tag
>  - Fixed "Fixes" tag with the help of Kuniyuki Iwashima (thanks !)
>
>  net/core/rtnetlink.c | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)
>
> diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
> index fae8034efbf..ee7d9d65b2c 100644
> --- a/net/core/rtnetlink.c
> +++ b/net/core/rtnetlink.c
> @@ -4059,8 +4059,15 @@ static int rtnl_newlink(struct sk_buff *skb, struct nlmsghdr *nlh,
>                                 ret = PTR_ERR(peer_net);
>                                 goto put_ops;
>                         }
> -                       if (peer_net)
> +                       if (peer_net) {
> +                               if (!netlink_ns_capable(skb, peer_net->user_ns,
> +                                                       CAP_NET_ADMIN)) {

I think this can be moved after the last rtnl_link_get_net_ifla()
in rtnl_get_peer_net().

If netns is not fetched from the peer tb, rtnl_link_get_net_capable()
just below this chunk will perform the same check redundantly.


> +                                       put_net(peer_net);
> +                                       ret = -EPERM;
> +                                       goto put_ops;
> +                               }
>                                 rtnl_nets_add(&rtnl_nets, peer_net);
> +                       }
>                 }
>         }
>
> --
> 2.34.1
>