| Message ID | 20260824221902.96694-1-pablo@netfilter.org |
|---|---|
| State | Not Applicable |
| Headers | show |
| Series | [nf] netfilter: lwtunnel: expose read-only sysctl nf_hooks_lwtunnel for non init-netns | expand |
Pablo Neira Ayuso <pablo@netfilter.org> wrote: > Expose nf_hooks_lwtunnel sysctl with 0444 mode from non init-netns > instead of 0644, sashiko reports this is exposing a global static branch > to modification by unprivileged users. No objection but I find this report weird. Why is that an issue in the first place? > Fixes: a2225e0250c5 ("netfilter: move the sysctl nf_hooks_lwtunnel into the netfilter core") AFAICS it was exposed before this too, just via conntrack module and not the core.
Hi Florian, On Tue, Aug 25, 2026 at 12:39:11AM +0200, Florian Westphal wrote: > Pablo Neira Ayuso <pablo@netfilter.org> wrote: > > Expose nf_hooks_lwtunnel sysctl with 0444 mode from non init-netns > > instead of 0644, sashiko reports this is exposing a global static branch > > to modification by unprivileged users. > > No objection but I find this report weird. Why is that an issue in the > first place? Sashiko specifies that this allows for unpriviledged user to turn on/off the nf_hooks_lwtunnel via static key, which is something that only init_net should be able to do. > > Fixes: a2225e0250c5 ("netfilter: move the sysctl nf_hooks_lwtunnel into the netfilter core") > > AFAICS it was exposed before this too, just via conntrack module and not the core. I can point to the initial patch: 7a3f5b0de364 ("netfilter: add netfilter hooks to SRv6 data plane")
diff --git a/net/netfilter/nf_hooks_lwtunnel.c b/net/netfilter/nf_hooks_lwtunnel.c index 4e1eef1ba0f1..0b4fca26233f 100644 --- a/net/netfilter/nf_hooks_lwtunnel.c +++ b/net/netfilter/nf_hooks_lwtunnel.c @@ -68,14 +68,18 @@ static int __net_init nf_lwtunnel_net_init(struct net *net) { const struct ctl_table *table; struct ctl_table_header *hdr; + struct ctl_table *dup; table = nf_lwtunnel_sysctl_table; if (!net_eq(net, &init_net)) { - table = kmemdup(nf_lwtunnel_sysctl_table, - sizeof(nf_lwtunnel_sysctl_table), - GFP_KERNEL); - if (!table) + dup = kmemdup(nf_lwtunnel_sysctl_table, + sizeof(nf_lwtunnel_sysctl_table), + GFP_KERNEL); + if (!dup) goto err_alloc; + + dup->mode = 0444; + table = dup; } hdr = register_net_sysctl_sz(net, "net/netfilter", table,
Expose nf_hooks_lwtunnel sysctl with 0444 mode from non init-netns instead of 0644, sashiko reports this is exposing a global static branch to modification by unprivileged users. Fixes: a2225e0250c5 ("netfilter: move the sysctl nf_hooks_lwtunnel into the netfilter core") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> --- net/netfilter/nf_hooks_lwtunnel.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)