Re: [PATCH iproute2] ss: document -K requirements in man page

[Stephen Hemminger <stephen@networkplumber.org>]

On Sun, 18 Oct 2026 18:19:17 +0000
Gopal Malaviya <gopalmalaviya53@gmail.com> wrote:

> The -K/--kill option uses SOCK_DESTROY, which the kernel only provides
> when built with CONFIG_INET_DIAG_DESTROY=y (default n). Closing a
> socket also requires CAP_NET_ADMIN. The man page mentions neither.
> 
> Without CONFIG_INET_DIAG_DESTROY, the kernel answers every SOCK_DESTROY
> request with EOPNOTSUPP. ss treats that the same as a single socket
> that cannot be closed and skips it silently, so nothing is closed, no
> error is printed and ss exits with status 0. For example, on a WSL2
> kernel (6.6.114.1-microsoft-standard-WSL2), running as root:
> 
>   # ss -tan '( sport = :52616 or dport = :52616 )'
>   State      Recv-Q Send-Q Local Address:Port  Peer Address:Port
>   FIN-WAIT-2 0      0          127.0.0.1:52616    127.0.0.1:58995
>   CLOSE-WAIT 1      0          127.0.0.1:58995    127.0.0.1:52616
>   # ss --kill -tan sport = :52616
>   State Recv-Q Send-Q Local Address:Port Peer Address:Port
>   # echo $?
>   0
>   # ss -tan '( sport = :52616 or dport = :52616 )'
>   State      Recv-Q Send-Q Local Address:Port  Peer Address:Port
>   FIN-WAIT-2 0      0          127.0.0.1:52616    127.0.0.1:58995
>   CLOSE-WAIT 1      0          127.0.0.1:58995    127.0.0.1:52616
> 
> With the same kernel rebuilt with CONFIG_INET_DIAG_DESTROY=y, the same
> --kill command closes the matching socket when run as root, and fails
> with "SOCK_DESTROY answers: Operation not permitted" without
> CAP_NET_ADMIN.
> 
> Making ss report this was discussed in 2016 [1] without agreement,
> since the kernel also returns EOPNOTSUPP for individual sockets that
> cannot be closed (e.g. some UDP or TIME_WAIT sockets on older kernels),
> and per-socket errors would be noisy on correctly configured systems.
> This patch does not change behaviour; it only documents both
> requirements and the silent case, so users can tell why -K had no
> effect.
> 
> Link: https://lore.kernel.org/netdev/1463442791-2399-2-git-send-email-dsa@cumulusnetworks.com/ [1]
> Signed-off-by: Gopal Malaviya <gopalmalaviya53@gmail.com>

Nak

I would rather not turn the iproute2 man pages into a laundry list
of how commands can fail if the kernel is configured without options.
There is a huge range of kernel config options and covering all of
them would make man pages into unreadable by humans noise.

Instead, it is best to just keep the error messages. The existing error
seems clear enough that operation was not permitted.