[PATCH net v3] rtnetlink: add missing netlink_ns_capable() check for peer netns

[PATCH net v3] rtnetlink: add missing netlink_ns_capable() check for peer netns

[Nikolaos Gkarlis]

rtnl_newlink() lacks a CAP_NET_ADMIN capability check on the peer
network namespace when creating paired devices (veth, vxcan,
netkit). This allows an unprivileged user with a user namespace
to create interfaces in arbitrary network namespaces, including
init_net.

Add a netlink_ns_capable() check for CAP_NET_ADMIN in the peer
namespace before allowing device creation to proceed.

Fixes: 81adee47dfb6 ("net: Support specifying the network namespace upon device creation.")
Signed-off-by: Nikolaos Gkarlis <nickgarlis@gmail.com>
---
v3:
  - Move netlink_ns_capable() check from rtnl_newlink() into
    rtnl_get_peer_net(), after the last rtnl_link_get_net_ifla(tb)
    call. The tbp path is already covered by rtnl_link_get_net_capable()
    in the caller. (suggested by Kuniyuki)
  - Pass skb to rtnl_get_peer_net() for the capability check.
  - Add IS_ERR() check on rtnl_link_get_net_ifla(tb) return value.
v2:
  - Removed "Reported-by" tag
  - Fixed "Fixes" tag with the help of Kuniyuki Iwashima (thanks !)

 net/core/rtnetlink.c | 20 +++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index fae8034efbf..4be7fc6e23a 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -3894,12 +3894,14 @@ static int rtnl_newlink_create(struct sk_buff *skb, struct ifinfomsg *ifm,
 	goto out;
 }
 
-static struct net *rtnl_get_peer_net(const struct rtnl_link_ops *ops,
+static struct net *rtnl_get_peer_net(struct sk_buff *skb,
+				     const struct rtnl_link_ops *ops,
 				     struct nlattr *tbp[],
 				     struct nlattr *data[],
 				     struct netlink_ext_ack *extack)
 {
 	struct nlattr *tb[IFLA_MAX + 1];
+	struct net *net;
 	int err;
 
 	if (!data || !data[ops->peer_type])
@@ -3915,7 +3917,19 @@ static struct net *rtnl_get_peer_net(const struct rtnl_link_ops *ops,
 			return ERR_PTR(err);
 	}
 
-	return rtnl_link_get_net_ifla(tb);
+	net = rtnl_link_get_net_ifla(tb);
+	if (IS_ERR(net))
+		return net;
+
+	if (!net)
+		return NULL;
+
+	if (!netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN)) {
+		put_net(net);
+		return ERR_PTR(-EPERM);
+	}
+
+	return net;
 }
 
 static int __rtnl_newlink(struct sk_buff *skb, struct nlmsghdr *nlh,
@@ -4054,7 +4068,7 @@ static int rtnl_newlink(struct sk_buff *skb, struct nlmsghdr *nlh,
 		}
 
 		if (ops->peer_type) {
-			peer_net = rtnl_get_peer_net(ops, tb, data, extack);
+			peer_net = rtnl_get_peer_net(skb, ops, tb, data, extack);
 			if (IS_ERR(peer_net)) {
 				ret = PTR_ERR(peer_net);
 				goto put_ops;
-- 
2.34.1

Re: [PATCH net v3] rtnetlink: add missing netlink_ns_capable() check for peer netns

[Kuniyuki Iwashima]

On Sat, Mar 28, 2026 at 6:52 AM Nikolaos Gkarlis <nickgarlis@gmail.com> wrote:
>
> rtnl_newlink() lacks a CAP_NET_ADMIN capability check on the peer
> network namespace when creating paired devices (veth, vxcan,
> netkit). This allows an unprivileged user with a user namespace
> to create interfaces in arbitrary network namespaces, including
> init_net.
>
> Add a netlink_ns_capable() check for CAP_NET_ADMIN in the peer
> namespace before allowing device creation to proceed.
>
> Fixes: 81adee47dfb6 ("net: Support specifying the network namespace upon device creation.")
> Signed-off-by: Nikolaos Gkarlis <nickgarlis@gmail.com>
> ---
> v3:
>   - Move netlink_ns_capable() check from rtnl_newlink() into
>     rtnl_get_peer_net(), after the last rtnl_link_get_net_ifla(tb)
>     call. The tbp path is already covered by rtnl_link_get_net_capable()
>     in the caller. (suggested by Kuniyuki)
>   - Pass skb to rtnl_get_peer_net() for the capability check.
>   - Add IS_ERR() check on rtnl_link_get_net_ifla(tb) return value.
> v2:
>   - Removed "Reported-by" tag
>   - Fixed "Fixes" tag with the help of Kuniyuki Iwashima (thanks !)
>
>  net/core/rtnetlink.c | 20 +++++++++++++++++---
>  1 file changed, 17 insertions(+), 3 deletions(-)
>
> diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
> index fae8034efbf..4be7fc6e23a 100644
> --- a/net/core/rtnetlink.c
> +++ b/net/core/rtnetlink.c
> @@ -3894,12 +3894,14 @@ static int rtnl_newlink_create(struct sk_buff *skb, struct ifinfomsg *ifm,
>         goto out;
>  }
>
> -static struct net *rtnl_get_peer_net(const struct rtnl_link_ops *ops,
> +static struct net *rtnl_get_peer_net(struct sk_buff *skb,
> +                                    const struct rtnl_link_ops *ops,
>                                      struct nlattr *tbp[],
>                                      struct nlattr *data[],
>                                      struct netlink_ext_ack *extack)
>  {
>         struct nlattr *tb[IFLA_MAX + 1];
> +       struct net *net;
>         int err;
>
>         if (!data || !data[ops->peer_type])
> @@ -3915,7 +3917,19 @@ static struct net *rtnl_get_peer_net(const struct rtnl_link_ops *ops,
>                         return ERR_PTR(err);
>         }
>
> -       return rtnl_link_get_net_ifla(tb);
> +       net = rtnl_link_get_net_ifla(tb);
> +       if (IS_ERR(net))

nit: use IS_ERR_OR_NULL and remove "if (!net) below


> +               return net;
> +
> +       if (!net)
> +               return NULL;
> +
> +       if (!netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN)) {
> +               put_net(net);
> +               return ERR_PTR(-EPERM);
> +       }
> +
> +       return net;
>  }
>
>  static int __rtnl_newlink(struct sk_buff *skb, struct nlmsghdr *nlh,
> @@ -4054,7 +4068,7 @@ static int rtnl_newlink(struct sk_buff *skb, struct nlmsghdr *nlh,
>                 }
>
>                 if (ops->peer_type) {
> -                       peer_net = rtnl_get_peer_net(ops, tb, data, extack);
> +                       peer_net = rtnl_get_peer_net(skb, ops, tb, data, extack);
>                         if (IS_ERR(peer_net)) {
>                                 ret = PTR_ERR(peer_net);
>                                 goto put_ops;
> --
> 2.34.1
>