nftables set/map operations failing in user namespace with Linux 7.1.6

Hi everyone,

I'm reaching out because I'm encountering an issue with nftables using set/map
operations (e.g., ip6 daddr set ip6 daddr map @forwardmap) inside user namespaces,
introduced somewhere between Linux 7.0.12 and 7.1.3.
I don't encounter the issue on the LTS Kernel (6.18.43).

If this is now intentionally restricted,
could you provide me with a workaround on kernels >= 7.1.3?

Context:
We (the kira-rust project) use nftables in the forwarding plane,
and rely on unshare to run our network emulation in isolated namespaces
as unprivileged user.


System Info:
- Distro: Arch Linux
- Kernel I tested:
  * 6.18.43-1-lts: succeeds
  * 7.0.12-arch1-1: succeeds
  * 7.1.3-arch2-2: fails
  * 7.1.5-arch1-2: fails
  * 7.1.6-arch1-1: fails
- nftables: v1.1.6
- Architecture: x86_64


Minimal Reproducible Example:
$ cat <<EOF | unshare -u -n --map-root user nft -f -
table ip6 foo {
    map forwardmap {
        type ipv6_addr : ipv6_addr
    }
    chain forward {
        ip6 daddr set ip6 daddr map @forwardmap
    }
}
EOF

Experienced Error:
/dev/stdin:6:9-17: Error: Could not process rule: Operation not permitted
        ip6 daddr set ip6 daddr map @forwardmap
        ^^^^^^^^^

Sincerely,


Julius Rüberg


kira-rust: https://gitlab.kit.edu/kit/tm/telematics/kira/kira-rust
KIRA project: https://s.kit.edu/kira