Re: [PATCH net v2 0/2] vxlan, geneve: require CAP_NET_ADMIN in the device netns for changelink

[patchwork-bot+netdevbpf]

Hello:

This series was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@xxxxxxxxxx>:

On Thu, 16 Jul 2026 22:34:58 +0200 you wrote:
> The recent series "require CAP_NET_ADMIN in the device netns for
> changelink" (8165f7ff57d9..27ccb68e7ccc) added rtnl_dev_link_net_capable()
> and gated the eight IP tunnel drivers (ip_gre, ipip, ip_vti, ip6_tunnel,
> ip6_gre, ip6_vti, sit, xfrm_interface). VXLAN and GENEVE share the exact
> same shape but were not covered: both store the underlay netns sticky at
> newlink (vxlan->net / geneve->net) and their changelink() operates on that
> netns, while the generic RTM_NEWLINK path only checks CAP_NET_ADMIN against
> dev_net(dev). Once such a device is created in or moved to another netns,
> a caller privileged in dev_net(dev) but not in the underlay netns can
> reconfigure the tunnel'"'"'s underlay.
> 
> [...]

Here is the summary with links:
  - [net,v2,1/2] vxlan: require CAP_NET_ADMIN in the device netns for changelink
    https://git.kernel.org/netdev/net/c/3a61bd9637f3
  - [net,v2,2/2] geneve: require CAP_NET_ADMIN in the device netns for changelink
    https://git.kernel.org/netdev/net/c/8efb8f8bbb35

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html