[PATCH nf] netfilter: lwtunnel: expose read-only sysctl nf_hooks_lwtunnel for non init-netns

[PATCH nf] netfilter: lwtunnel: expose read-only sysctl nf_hooks_lwtunnel for non init-netns

[Pablo Neira Ayuso]

Expose nf_hooks_lwtunnel sysctl with 0444 mode from non init-netns
instead of 0644, sashiko reports this is exposing a global static branch
to modification by unprivileged users.

Fixes: a2225e0250c5 ("netfilter: move the sysctl nf_hooks_lwtunnel into the netfilter core")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/netfilter/nf_hooks_lwtunnel.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/net/netfilter/nf_hooks_lwtunnel.c b/net/netfilter/nf_hooks_lwtunnel.c
index 4e1eef1ba0f1..0b4fca26233f 100644
--- a/net/netfilter/nf_hooks_lwtunnel.c
+++ b/net/netfilter/nf_hooks_lwtunnel.c
@@ -68,14 +68,18 @@ static int __net_init nf_lwtunnel_net_init(struct net *net)
 {
 	const struct ctl_table *table;
 	struct ctl_table_header *hdr;
+	struct ctl_table *dup;
 
 	table = nf_lwtunnel_sysctl_table;
 	if (!net_eq(net, &init_net)) {
-		table = kmemdup(nf_lwtunnel_sysctl_table,
-				sizeof(nf_lwtunnel_sysctl_table),
-				GFP_KERNEL);
-		if (!table)
+		dup = kmemdup(nf_lwtunnel_sysctl_table,
+			      sizeof(nf_lwtunnel_sysctl_table),
+			      GFP_KERNEL);
+		if (!dup)
 			goto err_alloc;
+
+		dup->mode = 0444;
+		table = dup;
 	}
 
 	hdr = register_net_sysctl_sz(net, "net/netfilter", table,
-- 
2.47.3

Re: [PATCH nf] netfilter: lwtunnel: expose read-only sysctl nf_hooks_lwtunnel for non init-netns

[Florian Westphal]

Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> Expose nf_hooks_lwtunnel sysctl with 0444 mode from non init-netns
> instead of 0644, sashiko reports this is exposing a global static branch
> to modification by unprivileged users.

No objection but I find this report weird.  Why is that an issue in the
first place?

> Fixes: a2225e0250c5 ("netfilter: move the sysctl nf_hooks_lwtunnel into the netfilter core")

AFAICS it was exposed before this too, just via conntrack module and not the core.

Re: [PATCH nf] netfilter: lwtunnel: expose read-only sysctl nf_hooks_lwtunnel for non init-netns

[Pablo Neira Ayuso]

Hi Florian,

On Tue, Aug 25, 2026 at 12:39:11AM +0200, Florian Westphal wrote:
> Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > Expose nf_hooks_lwtunnel sysctl with 0444 mode from non init-netns
> > instead of 0644, sashiko reports this is exposing a global static branch
> > to modification by unprivileged users.
> 
> No objection but I find this report weird.  Why is that an issue in the
> first place?

Sashiko specifies that this allows for unpriviledged user to turn
on/off the nf_hooks_lwtunnel via static key, which is something that
only init_net should be able to do.

> > Fixes: a2225e0250c5 ("netfilter: move the sysctl nf_hooks_lwtunnel into the netfilter core")
> 
> AFAICS it was exposed before this too, just via conntrack module and not the core.

I can point to the initial patch:

7a3f5b0de364 ("netfilter: add netfilter hooks to SRv6 data plane")