diff options
| author | Florian Westphal <fw@strlen.de> | 2026-04-25 15:00:50 +0200 |
|---|---|---|
| committer | Florian Westphal <fw@strlen.de> | 2026-05-24 22:55:37 +0200 |
| commit | ec1806a730a1c0b3d68a7f9afe81514fb0dd7991 (patch) | |
| tree | feb60a3f214d1648ae4bcfded55651fc594a84b0 /net/bridge/netfilter | |
| parent | c0aa5f13826dcb035bec3d6b252e6b2020fa5f88 (diff) | |
| download | linux-next-ec1806a730a1c0b3d68a7f9afe81514fb0dd7991.tar.gz linux-next-ec1806a730a1c0b3d68a7f9afe81514fb0dd7991.zip | |
netfilter: x_tables: disable 32bit compat interface in user namespaces
This feature is required to use 32bit arp/ip/ip6/ebtables binaries on
64bit kernels. I don't think there are many users left.
Support has been a compile-time option since 2021 and defaults to off
since 2023.
The XTABLES_COMPAT config option is already off in many distributions
including Debian and Fedora.
Give a few more months before complete removal but disable support in
user namespaces already.
Assisted-by: Claude:claude-sonnet-4-6
Signed-off-by: Florian Westphal <fw@strlen.de>
Diffstat (limited to 'net/bridge/netfilter')
| -rw-r--r-- | net/bridge/netfilter/ebtables.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c index b9f4daac09af..8d8f1a7c9ad5 100644 --- a/net/bridge/netfilter/ebtables.c +++ b/net/bridge/netfilter/ebtables.c @@ -2455,6 +2455,8 @@ static int do_ebt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len) if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) return -EPERM; + if (!xt_compat_check()) + return -EPERM; #ifdef CONFIG_NETFILTER_XTABLES_COMPAT /* try real handler in case userland supplied needed padding */ @@ -2520,6 +2522,8 @@ static int do_ebt_set_ctl(struct sock *sk, int cmd, sockptr_t arg, if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) return -EPERM; + if (!xt_compat_check()) + return -EPERM; switch (cmd) { case EBT_SO_SET_ENTRIES: |