Re: [PATCH net] macsec: require CAP_NET_ADMIN in the device netns for changelink

[Jakub Kicinski]

On Thu, 10 Sep 2026 12:20:49 +0000 netdev-bot+sashiko@xxxxxxxxxx wrote:
> >     An unconditional gate also denies the third case, which is a needless
> >     uAPI change; hence the narrower condition.  
> 
> Does the narrower condition still deny that same class of purely local
> request?  Would comparing nla_get_u8(data[IFLA_MACSEC_OFFLOAD]) against
> macsec->offload, so the gate fires only on an actual transition, keep that
> case working?

Sounds reasonable. Let's factor the checks out to a separate helper
function to avoid building very complex conditions in place.
-- 
pw-bot: cr