Re: [PATCH 3/3 net-next] ipv6: add CAP_NET_ADMIN check for forwarding and force_forwarding sysctl

On Tue, Jul 21, 2026 at 03:46:38PM +0200, Fernando Fernandez Mancera wrote:

On 7/21/26 2:24 PM, Ido Schimmel wrote:

quoted

On Thu, Jul 16, 2026 at 10:37:13PM +0200, Fernando Fernandez Mancera wrote:

quoted

As commit 8292d7f6e871 ("net: ipv4: add capability check for net
administration") did for IPv4, make sure that CAP_NET_ADMIN is required
to modify IPv6 forwarding and force_forwarding sysctl. This keep the
consistency of permission check logic between both protocols.

What's the value beyond protocol consistency given that it creates
intra-protocol inconsistency (none of the other IPv6 sysctl handlers
have this check)? 8292d7f6e871 does not explain why only forwarding was
changed. As-is, I don't see much value in this change. Tested using
[1].

Ideally, all IPv6 and IPv4 should require CAP_NET_ADMIN as they are indeed
configuring networking interface configuration. I thought changing all of
them all of a sudden would be too much so I went for forwarding only.

As to answer why it was done for IPv4 in first place, I guess it was done
because forwarding is the most popular option and also quite relevant in
terms of impact in the system behaviour.

If we don't want to merge this as it is, I see 3 ways forward:

1. drop this patch from the series
2. drop the permission check in IPv4 forwarding sysctl
3. extend the check to all sysctls of IPv4 and IPv6

Ideally I would go for 3. if it isn't too much in your opinion. Otherwise,
likely 1.

Please drop the patch given that it's merely trying to be consistent
with a change whose scope was never justified. Option 3 is not something
that fits in v2 of "Misc. minor improvements on IPv4/IPv6 sysctl
handling" and requires careful analysis / breakage assessment.