Re: [PATCH 3/3 net-next] ipv6: add CAP_NET_ADMIN check for forwarding and force_forwarding sysctl

[Ido Schimmel <idosch@nvidia.com>]

On Thu, Jul 16, 2026 at 10:37:13PM +0200, Fernando Fernandez Mancera wrote:
> As commit 8292d7f6e871 ("net: ipv4: add capability check for net
> administration") did for IPv4, make sure that CAP_NET_ADMIN is required
> to modify IPv6 forwarding and force_forwarding sysctl. This keep the
> consistency of permission check logic between both protocols.

What's the value beyond protocol consistency given that it creates
intra-protocol inconsistency (none of the other IPv6 sysctl handlers
have this check)? 8292d7f6e871 does not explain why only forwarding was
changed. As-is, I don't see much value in this change. Tested using
[1].

Before:

uid=0(root) gid=0(root) groups=0(root)
v4 fwd: 1
v4 rp_filter: 0
v6 fwd: 0
v6 accept_ra: 0

After:

uid=0(root) gid=0(root) groups=0(root)
v4 fwd: 1
v4 rp_filter: 0
v6 fwd: 1
v6 accept_ra: 0

[1]
#!/bin/bash

id
capsh --drop=cap_net_admin -- -c '
	sysctl -wq net.ipv4.conf.all.forwarding=1 &> /dev/null
	echo "v4 fwd: $?"
	sysctl -wq net.ipv4.conf.all.rp_filter=2 &> /dev/null
	echo "v4 rp_filter: $?"
	sysctl -wq net.ipv6.conf.all.forwarding=1 &> /dev/null
	echo "v6 fwd: $?"
	sysctl -wq net.ipv6.conf.all.accept_ra=2 &> /dev/null
	echo "v6 accept_ra: $?"
'