userns packet mangling

userns packet mangling

[Richard Van Tassel]

Hello, netfilter world.

I am very curious about the status of re-enabling packet mangling in
user namespaces.

I understand that it takes time to find and address security concerns,
and I hope the netfilter community takes all the time they need. That
being said, I just wanted to echo the appetite for that functionality
to return, similar to
582d218b638be68342dd80893c41746b35c1be76.camel@student.kit.edu (sorry
if I'm linking this incorrectly, I haven't used this sort of mailing
list before)

I am currently working around the disabling in a somewhat controlled
fashion using a custom kernel patch and module to allow a process in
init ns with CAP_NET_ADMIN to grant permission to mangle on a per-ns
basis. As I understand the situation currently, I don't think there's
much appetite for accepting this workaround as a kernel contribution,
since the disabling is meant to be temporary. But I feel like I should
mention it nevertheless.

Re: userns packet mangling

[Florian Westphal]

Richard Van Tassel <richard.van.tassel.work@gmail.com> wrote:
> Hello, netfilter world.
> 
> I am very curious about the status of re-enabling packet mangling in
> user namespaces.
> 
> I understand that it takes time to find and address security concerns,
> and I hope the netfilter community takes all the time they need. That
> being said, I just wanted to echo the appetite for that functionality
> to return, similar to
> 582d218b638be68342dd80893c41746b35c1be76.camel@student.kit.edu (sorry
> if I'm linking this incorrectly, I haven't used this sort of mailing
> list before)
 
> I am currently working around the disabling in a somewhat controlled
> fashion using a custom kernel patch and module to allow a process in
> init ns with CAP_NET_ADMIN to grant permission to mangle on a per-ns
> basis. As I understand the situation currently, I don't think there's
> much appetite for accepting this workaround as a kernel contribution,
> since the disabling is meant to be temporary. But I feel like I should
> mention it nevertheless.

https://patchwork.ozlabs.org/project/netfilter-devel/patch/20260905050150.30273-1-fw@strlen.de/

is still pending, and its closing known security hole.
So no, for now we can't re-enable this feature.

Re: userns packet mangling

[Pablo Neira Ayuso]

On Sat, Oct 17, 2026 at 12:51:05AM +0200, Florian Westphal wrote:
> Richard Van Tassel <richard.van.tassel.work@gmail.com> wrote:
> > Hello, netfilter world.
> > 
> > I am very curious about the status of re-enabling packet mangling in
> > user namespaces.
> > 
> > I understand that it takes time to find and address security concerns,
> > and I hope the netfilter community takes all the time they need. That
> > being said, I just wanted to echo the appetite for that functionality
> > to return, similar to
> > 582d218b638be68342dd80893c41746b35c1be76.camel@student.kit.edu (sorry
> > if I'm linking this incorrectly, I haven't used this sort of mailing
> > list before)
>  
> > I am currently working around the disabling in a somewhat controlled
> > fashion using a custom kernel patch and module to allow a process in
> > init ns with CAP_NET_ADMIN to grant permission to mangle on a per-ns
> > basis. As I understand the situation currently, I don't think there's
> > much appetite for accepting this workaround as a kernel contribution,
> > since the disabling is meant to be temporary. But I feel like I should
> > mention it nevertheless.
> 
> https://patchwork.ozlabs.org/project/netfilter-devel/patch/20260905050150.30273-1-fw@strlen.de/
> 
> is still pending, and its closing known security hole.
> So no, for now we can't re-enable this feature.

I will pick this in the next nf.git PR.