Re: [PATCH nf] netfilter: lwtunnel: expose read-only sysctl nf_hooks_lwtunnel for non init-netns

Hi Florian,

On Tue, Aug 25, 2026 at 12:39:11AM +0200, Florian Westphal wrote:
> Pablo Neira Ayuso <[email protected]> wrote:
> > Expose nf_hooks_lwtunnel sysctl with 0444 mode from non init-netns
> > instead of 0644, sashiko reports this is exposing a global static branch
> > to modification by unprivileged users.
> 
> No objection but I find this report weird.  Why is that an issue in the
> first place?

Sashiko specifies that this allows for unpriviledged user to turn
on/off the nf_hooks_lwtunnel via static key, which is something that
only init_net should be able to do.

> > Fixes: a2225e0250c5 ("netfilter: move the sysctl nf_hooks_lwtunnel into the netfilter core")
> 
> AFAICS it was exposed before this too, just via conntrack module and not the core.

I can point to the initial patch:

7a3f5b0de364 ("netfilter: add netfilter hooks to SRv6 data plane")