Re: [PATCH 3/3 net-next] ipv6: add CAP_NET_ADMIN check for forwarding and force_forwarding sysctl

On 7/21/26 2:24 PM, Ido Schimmel wrote:

On Thu, Jul 16, 2026 at 10:37:13PM +0200, Fernando Fernandez Mancera wrote:

quoted

As commit 8292d7f6e871 ("net: ipv4: add capability check for net
administration") did for IPv4, make sure that CAP_NET_ADMIN is required
to modify IPv6 forwarding and force_forwarding sysctl. This keep the
consistency of permission check logic between both protocols.

What's the value beyond protocol consistency given that it creates
intra-protocol inconsistency (none of the other IPv6 sysctl handlers
have this check)? 8292d7f6e871 does not explain why only forwarding was
changed. As-is, I don't see much value in this change. Tested using
[1].

Ideally, all IPv6 and IPv4 should require CAP_NET_ADMIN as they are 
indeed configuring networking interface configuration. I thought 
changing all of them all of a sudden would be too much so I went for 
forwarding only.

As to answer why it was done for IPv4 in first place, I guess it was 
done because forwarding is the most popular option and also quite 
relevant in terms of impact in the system behaviour.

If we don't want to merge this as it is, I see 3 ways forward:

1. drop this patch from the series
2. drop the permission check in IPv4 forwarding sysctl
3. extend the check to all sysctls of IPv4 and IPv6

Ideally I would go for 3. if it isn't too much in your opinion. 
Otherwise, likely 1.

Thanks,
Fernando.

Before:

uid=0(root) gid=0(root) groups=0(root)
v4 fwd: 1
v4 rp_filter: 0
v6 fwd: 0
v6 accept_ra: 0

After:

uid=0(root) gid=0(root) groups=0(root)
v4 fwd: 1
v4 rp_filter: 0
v6 fwd: 1
v6 accept_ra: 0

[1]
#!/bin/bash

id
capsh --drop=cap_net_admin -- -c '
	sysctl -wq net.ipv4.conf.all.forwarding=1 &> /dev/null
	echo "v4 fwd: $?"
	sysctl -wq net.ipv4.conf.all.rp_filter=2 &> /dev/null
	echo "v4 rp_filter: $?"
	sysctl -wq net.ipv6.conf.all.forwarding=1 &> /dev/null
	echo "v6 fwd: $?"
	sysctl -wq net.ipv6.conf.all.accept_ra=2 &> /dev/null
	echo "v6 accept_ra: $?"
'