Re: [PATCH] ppp: require CAP_NET_ADMIN in target netns for unattached ioctls

[Qingfang Deng <qingfang.deng@linux.dev>]

Hi,

Added Cc: Cyrill, and Matteo

On 2026/4/8 12:23, Taegu Ha wrote:
> /dev/ppp open is currently authorized against file->f_cred->user_ns,
> while unattached administrative ioctls operate on current->nsproxy->net_ns.
>
> As a result, a local unprivileged user can create a new user namespace
> with CLONE_NEWUSER, gain CAP_NET_ADMIN only in that new user namespace,
> and still issue PPPIOCNEWUNIT, PPPIOCATTACH, or PPPIOCATTCHAN against
> an inherited network namespace.
>
> Require CAP_NET_ADMIN in the user namespace that owns the target network
> namespace before handling these unattached PPP administrative ioctls.
>
> This preserves normal pppd operation in the network namespace it is
> actually privileged in, while rejecting the userns-only inherited-netns
> case.
>
> Fixes: 273ec51dd7ce ("net: ppp_generic - introduce net-namespace functionality v2")

For fixes, you should set the target tree to "net" in the patch subject, 
using:

git format-patch --subject-prefix="PATCH net"


> Reported-by: Taegu Ha <hataegu0826@gmail.com>

Minor nit: Reported-by tag is not needed if it's the same user as Signed-off-by.

> Signed-off-by: Taegu Ha <hataegu0826@gmail.com>
> ---
>   drivers/net/ppp/ppp_generic.c | 9 +++++++++
>   1 file changed, 9 insertions(+)
>
> diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
> index e9b41777be80..99a8557188c0 100644
> --- a/drivers/net/ppp/ppp_generic.c
> +++ b/drivers/net/ppp/ppp_generic.c
> @@ -1059,6 +1059,9 @@ static int ppp_unattached_ioctl(struct net *net, struct ppp_file *pf,
>   
>   	switch (cmd) {
>   	case PPPIOCNEWUNIT:
> +		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
> +			return -EPERM;
> +


These three identical checks can be combined into one and placed before 
the switch statement.


>   		/* Create a new ppp unit */
>   		if (get_user(unit, p))
>   			break;
> @@ -1073,6 +1076,9 @@ static int ppp_unattached_ioctl(struct net *net, struct ppp_file *pf,
>   		break;
>   
>   	case PPPIOCATTACH:
> +		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
> +			return -EPERM;
> +
>   		/* Attach to an existing ppp unit */
>   		if (get_user(unit, p))
>   			break;
> @@ -1089,6 +1095,9 @@ static int ppp_unattached_ioctl(struct net *net, struct ppp_file *pf,
>   		break;
>   
>   	case PPPIOCATTCHAN:
> +		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
> +			return -EPERM;
> +
>   		if (get_user(unit, p))
>   			break;
>   		err = -ENXIO;