Re: [PATCH] ppp: require CAP_NET_ADMIN in target netns for unattached ioctls

On Wed, Apr 8, 2026 at 8:28 AM Qingfang Deng <[email protected]> wrote:
>
> >
> Hi,
>
> Added Cc: Cyrill, and Matteo
>
> On 2026/4/8 12:23, Taegu Ha wrote:
> > /dev/ppp open is currently authorized against file->f_cred->user_ns,
> > while unattached administrative ioctls operate on current->nsproxy->net_ns.
> >
> > As a result, a local unprivileged user can create a new user namespace
> > with CLONE_NEWUSER, gain CAP_NET_ADMIN only in that new user namespace,
> > and still issue PPPIOCNEWUNIT, PPPIOCATTACH, or PPPIOCATTCHAN against
> > an inherited network namespace.
> >
> > Require CAP_NET_ADMIN in the user namespace that owns the target network
> > namespace before handling these unattached PPP administrative ioctls.
> >
> > This preserves normal pppd operation in the network namespace it is
> > actually privileged in, while rejecting the userns-only inherited-netns
> > case.
> >
> > Fixes: 273ec51dd7ce ("net: ppp_generic - introduce net-namespace functionality v2")
>
> For fixes, you should set the target tree to "net" in the patch subject,
> using:
>

LGTM as long as it's still possible to start a pppd from within a user
an network namespace.

Regards,
-- 
Matteo Croce