github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 09:36:22 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

netfilter: x_tables: disable 32bit compat interface in user namespaces

Browse Source 
This feature is required to use 32bit arp/ip/ip6/ebtables binaries on
64bit kernels.  I don't think there are many users left.

Support has been a compile-time option since 2021 and defaults to off
since 2023.

The XTABLES_COMPAT config option is already off in many distributions
including Debian and Fedora.

Give a few more months before complete removal but disable support in
user namespaces already.

Assisted-by: Claude:claude-sonnet-4-6
Signed-off-by: Florian Westphal <fw@strlen.de>
This commit is contained in:
Florian Westphal 2026-04-25 15:00:50 +02:00
parent c0aa5f1382
commit ec1806a730
5 changed files with 33 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
include/linux/netfilter/x_tables.h
View File

@ -534,4 +534,21 @@ int xt_compat_check_entry_offsets(const void *base, const char *elems,
unsigned int next_offset);
#endif /* CONFIG_NETFILTER_XTABLES_COMPAT */
static inline bool xt_compat_check(void)
{
#ifdef CONFIG_NETFILTER_XTABLES_COMPAT
if (!in_compat_syscall())
return true;
pr_warn_once("%s %s\n",
"xtables 32bit compat interface no longer supported",
"in namespaces and will be removed soon.");
if (!capable(CAP_NET_ADMIN))
return false;
#endif
return true;
}
#endif /* _X_TABLES_H */

4
net/bridge/netfilter/ebtables.c
View File

@ -2455,6 +2455,8 @@ static int do_ebt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
return -EPERM;
if (!xt_compat_check())
return -EPERM;
#ifdef CONFIG_NETFILTER_XTABLES_COMPAT
/* try real handler in case userland supplied needed padding */
@ -2520,6 +2522,8 @@ static int do_ebt_set_ctl(struct sock *sk, int cmd, sockptr_t arg,
if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
return -EPERM;
if (!xt_compat_check())
return -EPERM;
switch (cmd) {
case EBT_SO_SET_ENTRIES:

4
net/ipv4/netfilter/arp_tables.c
View File

@ -1430,6 +1430,8 @@ static int do_arpt_set_ctl(struct sock *sk, int cmd, sockptr_t arg,
if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
return -EPERM;
if (!xt_compat_check())
return -EPERM;
switch (cmd) {
case ARPT_SO_SET_REPLACE:
@ -1458,6 +1460,8 @@ static int do_arpt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len
if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
return -EPERM;
if (!xt_compat_check())
return -EPERM;
switch (cmd) {
case ARPT_SO_GET_INFO:

4
net/ipv4/netfilter/ip_tables.c
View File

@ -1624,6 +1624,8 @@ do_ipt_set_ctl(struct sock *sk, int cmd, sockptr_t arg, unsigned int len)
if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
return -EPERM;
if (!xt_compat_check())
return -EPERM;
switch (cmd) {
case IPT_SO_SET_REPLACE:
@ -1653,6 +1655,8 @@ do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
return -EPERM;
if (!xt_compat_check())
return -EPERM;
switch (cmd) {
case IPT_SO_GET_INFO:

4
net/ipv6/netfilter/ip6_tables.c
View File

@ -1633,6 +1633,8 @@ do_ip6t_set_ctl(struct sock *sk, int cmd, sockptr_t arg, unsigned int len)
if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
return -EPERM;
if (!xt_compat_check())
return -EPERM;
switch (cmd) {
case IP6T_SO_SET_REPLACE:
@ -1662,6 +1664,8 @@ do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
return -EPERM;
if (!xt_compat_check())
return -EPERM;
switch (cmd) {
case IP6T_SO_GET_INFO: