From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.85.160.169 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793892562; b=xJ8Gyn8i5BYDULmrqIXb/H2clQx5nmseK8vjKjc4KhWBuLsk1e5PcLGsPblo9P6tduQC qh53C1pL60l1oGoEDrFHkeuepLpbiI/cJlj9sZZuKuin5KTlmOQeZogO2bel5lh9MICGE qkzdLQqRhIuY1uGC/U9xOTJAeOUyo9OPVkVa+HYgNxN5i4v7jBkkQUdz0D4uenmLrsU07 fTYEAEqgADo4AAGdIKXyAIe+ktE/awhcYVV8fbafYAIZIwbguReXbc0/PX8JoU3staKMG PPftVeMEnWgP+JorCjG6NBlJwyExn1ve5TnVzJ/nK9eKhvO6JX2q7IN/baN6DwakPoQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793892562; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Gm-Gg:X-Received:Received: From:Date:Subject:MIME-Version:Content-Type:Content-Transfer-Encoding: Message-Id:References:In-Reply-To:To:Cc:X-Mailer: X-Developer-Signature:X-Developer-Key; bh=KC1P9xd8KeLFJ3ASyqlrJ/hNXCN2H3jOINElMkwNYZk=; b=cWW7riraVQcQby6nzkx5HKwm4pfErb/QGyPA70jpbkQLL1NNSgESgPMHna6iWqFopG4/ FvPcT7JPkZhldpQzuOgcLx9h3VhfMHq8crX0C1qn4arvXiz/jhPW4HN2G+wtlQPr30lZM AT7EiZSttOAZlbAHhviiC/suATo6jTZW/BO6ygYW/wahhcWOXh8VtBVCeZ3bM8uevy0Y5 AFYfT9CH0t+S6esMxaEa3lW0LiN9XYPBL6Z6YK3Kr5DXqMMnzDe/g1er4ZeHe9Oguzp2A BA1OtI6Hr6Ij8NWFUqNVF+FH2G/BWn5lgcp7zAjiQMAmgQam5KRm+CVV/XE2urEJdrQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none header.from=toxicpanda.com; spf=pass smtp.mailfrom=toxicpanda.com; dkim=pass header.d=toxicpanda.com header.i=@toxicpanda.com header.a=rsa-sha256 header.s=google header.b=M4bTNF3C; arc=none smtp.remote-ip=209.85.160.169 Received: from mail-qt1-f169.google.com (mail-qt1-f169.google.com [209.85.160.169]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 51304606A31B for ; Thu, 5 Nov 2026 15:29:21 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 51304606A31B Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=toxicpanda.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=toxicpanda.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=toxicpanda.com header.i=@toxicpanda.com header.a=rsa-sha256 header.s=google header.b=M4bTNF3C Received: by mail-qt1-f169.google.com with SMTP id d75a77b69052e-53e1d40628eso8930521cf.0 for ; Thu, 05 Nov 2026 07:29:21 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=toxicpanda.com; s=google; t=1793892560; x=1794497360; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=KC1P9xd8KeLFJ3ASyqlrJ/hNXCN2H3jOINElMkwNYZk=; b=M4bTNF3CC3/yhwIDRY+8iGLI2VeNi3jCab2rq43jVt7L6wnonBA9EqnUPaRi/X+Be4 yGTxbn5RodRsBBBJGNNcP6/B58ehY0IefqFkl/sirjyVL+wSPcbaijY37uOFTOPMbkkV lhXZe9TlmiQA4qGN4txgi7n6dPz3g0Fm40vt8HugNxcJlf9et+ajzYdLudKJerR7TVRp pgOhCbsLgI8hWaVaG0fMBOyKZxpbpwHuE3tC6L0EEcsokhrGrAE3oWwKgG9QqOwPJuby txzaGXJXLWqK3A7fS0my2zPYjSiyA6xWiEbYxtiqiWQjkOvXBHwv7ut88tpKROV5t3d6 oIOQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793892560; x=1794497360; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=KC1P9xd8KeLFJ3ASyqlrJ/hNXCN2H3jOINElMkwNYZk=; b=YsqAvmNjWTHHSw92vxRhJu+0ahv50E5PuD1RaXpT1a4x+KgFgWnwV3zKSCDXZJ/Pws SJf93eHivD2ZedXIWKYTyvqGtBlDB1a1hARGYeC7SYGc3z0FpgrhV2xJwwn52ptDAsqz b1ZLEFXqhd7akCML7qO6W3qbu1dTDq1Farx6gTETFz4FztiSGdA81sNr6gbbueUtJ3iC qkD/dOFv7gt228uicmzZ0q+fz6uxwcwPcatV2s5xsFa9Z7OaYEhTNegniVf0uXbHGnck /5YwMZgKjskXBdEAqm6h6dE8Ew88tW3moPBcY1/mRjEqtTdUuVpae1VYBiA6CE0El9Iz yeCQ== X-Forwarded-Encrypted: i=1; AKwUvByug0RzMErP76YEH4fWmD8pYFtMe7qmNOWnpUIg0lB7CYhks6S39+0V+8WbF8N8e4ZCrXNL4ploJtd3ZS4=@vger.kernel.org X-Gm-Message-State: APuU4Z+ajDBZ7W3482sIncFjZlVouu9+owlLFrbgYd0dbAoPKWU5lpOT vjVnkyhH/yReEXeJjgavELfh14KD5+61YbVX9UdRXrtnQraz2vsSX+qO7MDIQquV6vI= X-Gm-Gg: AYBFou0rJd1b3im3nn5Us3O2C83SpPS2BDAivz4EUCfYmM3wlNys09APu6rvLnVI95D g+hqXeq1PHh5Aq/gD4Myj9MCRD00XppQH/r/23s1AO+/YEzcSsW3ub3YN56Pwc4/sPIy5OZm9hy ZbIguyeDH6bp92T6ZtNLcSmhrk9x90Ogqz6+hGMQtc5f7bQ4yLxCTSpcA/4X++SIt5DvB11lsub 11T0b2E/b9PlZcuTKoZx05LWoGuRfnBWYhJ5mvT0Zai9OqyCnSFgyy9Guk7K7xgXw5CHObcNr5I naGAfPcsR925/goCFyOj82CQVr4r5eUmWkyDKheJVtc8c6mu4IkFegnDOWb30wotQnAl0wrFD+X 5OpyFUiLgmqLofm5+KXiyu9hy1PCKdK1IoH+ecpQrF14Dudo0XTVL3Whcz/2Ehyp5yiEpzu5Yq6 jqVQaN8R1WPqozBMg+hL0jiy4UWrVcbk63GwrTwGZPfE3Q/1G655RS1pjqbJzyHMvZEPsfK9VaN CruUiVL0TLr69jnCJQLsQ/jnWZFWTPOYg+6L7FOU+dxD5trFQEhrtezR0VR87GkA68PgqWg3rnQ u0GawU9KU+Zvyz+bwG5GCiZ5hvELCWupIuV6QUZPviEFTA== X-Received: by 2002:a05:622a:298c:b0:536:6c22:e340 with SMTP id d75a77b69052e-54c9b42d7d1mr43109361cf.23.1793892560388; Thu, 05 Nov 2026 07:29:20 -0800 (PST) Received: from toxicpanda.com ([153.61.196.250]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-54b10ff4bcdsm53469321cf.29.2026.11.05.07.29.19 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Nov 2026 07:29:19 -0800 (PST) From: Josef Bacik Date: Thu, 05 Nov 2026 15:03:11 +0000 Subject: [PATCH RFC v3 79/90] tun: use net_may() to create and attach to devices X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20261105-b4-cells-v3-79-bc9095937a84@toxicpanda.com> References: <20261105-b4-cells-v3-0-bc9095937a84@toxicpanda.com> In-Reply-To: <20261105-b4-cells-v3-0-bc9095937a84@toxicpanda.com> To: Christian Brauner , James Bottomley , Andrew Halaney , Jeremy Bingham , Tahera Fahimi , Serge Hallyn Cc: linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, Josef Bacik X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openssh-sha256; t=1793890936; l=1289; i=josef@toxicpanda.com; h=from:subject:message-id; bh=UXbdA9UCvz4x1PWOKgL33Jk7+yRkjhiRV3vbT8d950k=; b=U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgUBr36M/n0nWN0DNbnxwzIiCZez6MG JiruuNaSCI/zXsAAAAGcGF0YXR0AAAAAAAAAAZzaGE1MTIAAABTAAAAC3NzaC1lZDI1NTE5AAAA QPFDE7PYNp80VBVXSR1Y9WyTzPU9AUwmHrPnOYrC6PaDVqonKcEf7Kaa4IZUHQQ1zwUpErB/6KZ SR1Pg/wC+4Qc= X-Developer-Key: i=josef@toxicpanda.com; a=openssh; fpr=SHA256:C8kOX2QUJCMqnCX+KEeoqRAjLo9L+ELOSH2NSAJHqGA Creating a tun or tap device requires CAP_NET_ADMIN. So does attaching to a device unless the caller is its owner or a member of its group. Convert both checks to NET_RIGHT_TUN. SIOCGSKNS and TUNGETDEVNETNS return a file descriptor for a network namespace. They keep the plain capability check. No functional change. Signed-off-by: Josef Bacik --- drivers/net/tun.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/tun.c b/drivers/net/tun.c index dcec7311e601..0a2f864a253e 100644 --- a/drivers/net/tun.c +++ b/drivers/net/tun.c @@ -524,7 +524,7 @@ static inline bool tun_permitted(struct tun_struct *tun) (!gid_valid(tun->group) || in_egroup_p(tun->group))) return true; - return ns_capable(net->user_ns, CAP_NET_ADMIN); + return net_may(net, NET_RIGHT_TUN); } static void tun_set_real_num_queues(struct tun_struct *tun) @@ -2924,7 +2924,7 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr) int queues = ifr->ifr_flags & IFF_MULTI_QUEUE ? MAX_TAP_QUEUES : 1; - if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) + if (!net_may(net, NET_RIGHT_TUN)) return -EPERM; err = security_tun_dev_create(); if (err < 0) -- 2.55.0