Re: [PATCH] bpf: netns: require CAP_NET_ADMIN for link targets

["Jérémy Jean" <jeremy.jean@oss.cyber.gouv.fr>]

On 2026-11-02 23:08, Alexei Starovoitov wrote:
> On Mon, Nov 02, 2026 at 12:29 PM Jérémy Jean 
> <Jeremy.Jean@oss.cyber.gouv.fr> wrote:
>> BPF tokens allow a process to load BPF programs using CAP_NET_ADMIN in
>> a userns, however, netns_bpf_link_create() does not check for
>> CAP_NET_ADMIN in the target netns. Consequently, a token can be used
>> to attach a BPF program to a netns it does not control.
> 
> That's not a gap. The prog FD and the netns FD are the permission.
> 
> pw-bot: cr

Thanks for the reply, yet I feel that I misunderstood something.
At first, it seemed to me that there was a security boundary issue,
but digging more with your feedback and Sashiko's one, I believe I was 
wrong,
that there is no issue and that this patch should instead simply be 
dropped.
Am I right? Or do you believe that there are still things to fix?

Regards,
Jérémy