diff options
| author | Florian Westphal <fw@strlen.de> | 2026-04-25 15:00:50 +0200 |
|---|---|---|
| committer | Florian Westphal <fw@strlen.de> | 2026-05-24 22:55:37 +0200 |
| commit | ec1806a730a1c0b3d68a7f9afe81514fb0dd7991 (patch) | |
| tree | feb60a3f214d1648ae4bcfded55651fc594a84b0 /net/ipv4/netfilter | |
| parent | c0aa5f13826dcb035bec3d6b252e6b2020fa5f88 (diff) | |
| download | linux-next-ec1806a730a1c0b3d68a7f9afe81514fb0dd7991.tar.gz linux-next-ec1806a730a1c0b3d68a7f9afe81514fb0dd7991.zip | |
netfilter: x_tables: disable 32bit compat interface in user namespaces
This feature is required to use 32bit arp/ip/ip6/ebtables binaries on
64bit kernels. I don't think there are many users left.
Support has been a compile-time option since 2021 and defaults to off
since 2023.
The XTABLES_COMPAT config option is already off in many distributions
including Debian and Fedora.
Give a few more months before complete removal but disable support in
user namespaces already.
Assisted-by: Claude:claude-sonnet-4-6
Signed-off-by: Florian Westphal <fw@strlen.de>
Diffstat (limited to 'net/ipv4/netfilter')
| -rw-r--r-- | net/ipv4/netfilter/arp_tables.c | 4 | ||||
| -rw-r--r-- | net/ipv4/netfilter/ip_tables.c | 4 |
2 files changed, 8 insertions, 0 deletions
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c index ad2259678c78..341ae049e5a2 100644 --- a/net/ipv4/netfilter/arp_tables.c +++ b/net/ipv4/netfilter/arp_tables.c @@ -1430,6 +1430,8 @@ static int do_arpt_set_ctl(struct sock *sk, int cmd, sockptr_t arg, if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) return -EPERM; + if (!xt_compat_check()) + return -EPERM; switch (cmd) { case ARPT_SO_SET_REPLACE: @@ -1458,6 +1460,8 @@ static int do_arpt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) return -EPERM; + if (!xt_compat_check()) + return -EPERM; switch (cmd) { case ARPT_SO_GET_INFO: diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c index 5cbdb0815857..f917a9004a01 100644 --- a/net/ipv4/netfilter/ip_tables.c +++ b/net/ipv4/netfilter/ip_tables.c @@ -1624,6 +1624,8 @@ do_ipt_set_ctl(struct sock *sk, int cmd, sockptr_t arg, unsigned int len) if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) return -EPERM; + if (!xt_compat_check()) + return -EPERM; switch (cmd) { case IPT_SO_SET_REPLACE: @@ -1653,6 +1655,8 @@ do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len) if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) return -EPERM; + if (!xt_compat_check()) + return -EPERM; switch (cmd) { case IPT_SO_GET_INFO: |