Deletion of FDB entries requires CAP_NET_ADMIN, yet, processes in a non-initial user namespace receive an EPERM because the capability is always checked against the initial user namespace. This restricts the FDB management from unprivileged containers. Replace netlink_capable with netlink_net_capable that performs the capability check on the user namespace the netlink socket was opened in. This patch was tested using a container on GyroidOS, where it was possible to delete FDB entries from an unprivileged user namespace and private network namespace. Reviewed-by: Michael Weiß Tested-by: Harshal Gohel Signed-off-by: Johannes Wiesböck --- net/core/rtnetlink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c index 094b085cff206..2f96258bd4fd7 100644 --- a/net/core/rtnetlink.c +++ b/net/core/rtnetlink.c @@ -4707,7 +4707,7 @@ static int rtnl_fdb_del(struct sk_buff *skb, struct nlmsghdr *nlh, int err; u16 vid; - if (!netlink_capable(skb, CAP_NET_ADMIN)) + if (!netlink_net_capable(skb, CAP_NET_ADMIN)) return -EPERM; if (!del_bulk) { -- 2.51.0