[PATCH 3/3 net-next] ipv6: add CAP_NET_ADMIN check for forwarding and force_forwarding sysctl
From: Fernando Fernandez Mancera <hidden>
Date: 2026-07-16 20:37:48
Subsystem:
networking [general], networking [ipv4/ipv6], the rest · Maintainers:
"David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, David Ahern, Ido Schimmel, Linus Torvalds
As commit 8292d7f6e871 ("net: ipv4: add capability check for net
administration") did for IPv4, make sure that CAP_NET_ADMIN is required
to modify IPv6 forwarding and force_forwarding sysctl. This keep the
consistency of permission check logic between both protocols.
Signed-off-by: Fernando Fernandez Mancera <redacted>
---
net/ipv6/addrconf.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index f6fa2715b450..b2a0e6a4189d 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c@@ -6363,11 +6363,15 @@ static void ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp) static int addrconf_sysctl_forward(const struct ctl_table *ctl, int write, void *buffer, size_t *lenp, loff_t *ppos) { + struct net *net = ctl->extra2; struct ctl_table lctl; int *valp = ctl->data; int val = *valp; int ret; + if (write && !ns_capable(net->user_ns, CAP_NET_ADMIN)) + return -EPERM; + /* * ctl->data points to idev->cnf.forwarding, we should * not modify it until we get the rtnl lock.
@@ -6805,6 +6809,9 @@ static int addrconf_sysctl_force_forwarding(const struct ctl_table *ctl, int wri int old_val = *valp; int ret; + if (write && !ns_capable(net->user_ns, CAP_NET_ADMIN)) + return -EPERM; + tmp_ctl.extra1 = SYSCTL_ZERO; tmp_ctl.extra2 = SYSCTL_ONE; tmp_ctl.data = &new_val;
--
2.55.0