Re: [PATCH ovpn net-next v4 1/3] ovpn: support operations on interfaces in foreign netns

Hi Sabrina!
> On 08/14/2026 1:31 PM CEST Sabrina Dubroca <[email protected]> wrote:
> 
>  
> 2026-08-06, 17:49:46 +0200, Marco Baffo wrote:
> > ovpn currently looks up the target interface in the network namespace
> > associated with the netlink socket. This prevents a userspace process
> > from controlling an ovpn interface located in another namespace.
> > 
> > Add the optional OVPN_A_TARGET_NETNSID attribute. When present, it
> > identifies the namespace containing the target interface relative to the
> > namespace of the requesting Netlink socket. Resolve the ID and perform
> > the interface lookup there. When absent, preserve the existing lookup
> > behavior.
> 
> I'm not so sure about this. Why not open a socket in the target netns
> directly?
> 
> Also, all this cross-net stuff is a pain wrt permissions.

Currently, doing this without that attribute requires a non-trivial socket dance and having the attribute avoids that entirely.
What's the rationale for other drivers having that attribute? And do you have any idea what the current general feeling among maintainers is?
Wrt permissions, I can send a follow-up patch that also checks CAP_NET_ADMIN via netlink_ns_capable() when a message containing TARGET_NETNSID arrives.

---
Marco