Re: [PATCH 3/3 net-next] ipv6: add CAP_NET_ADMIN check for forwarding and force_forwarding sysctl

[Ido Schimmel <idosch@nvidia.com>]

On Tue, Jul 21, 2026 at 03:46:38PM +0200, Fernando Fernandez Mancera wrote:
> On 7/21/26 2:24 PM, Ido Schimmel wrote:
> > On Thu, Jul 16, 2026 at 10:37:13PM +0200, Fernando Fernandez Mancera wrote:
> > > As commit 8292d7f6e871 ("net: ipv4: add capability check for net
> > > administration") did for IPv4, make sure that CAP_NET_ADMIN is required
> > > to modify IPv6 forwarding and force_forwarding sysctl. This keep the
> > > consistency of permission check logic between both protocols.
> > 
> > What's the value beyond protocol consistency given that it creates
> > intra-protocol inconsistency (none of the other IPv6 sysctl handlers
> > have this check)? 8292d7f6e871 does not explain why only forwarding was
> > changed. As-is, I don't see much value in this change. Tested using
> > [1].
> > 
> 
> Ideally, all IPv6 and IPv4 should require CAP_NET_ADMIN as they are indeed
> configuring networking interface configuration. I thought changing all of
> them all of a sudden would be too much so I went for forwarding only.
> 
> As to answer why it was done for IPv4 in first place, I guess it was done
> because forwarding is the most popular option and also quite relevant in
> terms of impact in the system behaviour.
> 
> If we don't want to merge this as it is, I see 3 ways forward:
> 
> 1. drop this patch from the series
> 2. drop the permission check in IPv4 forwarding sysctl
> 3. extend the check to all sysctls of IPv4 and IPv6
> 
> Ideally I would go for 3. if it isn't too much in your opinion. Otherwise,
> likely 1.

Please drop the patch given that it's merely trying to be consistent
with a change whose scope was never justified. Option 3 is not something
that fits in v2 of "Misc. minor improvements on IPv4/IPv6 sysctl
handling" and requires careful analysis / breakage assessment.