Re: [PATCH] bpf: netns: require CAP_NET_ADMIN for link targets

[Alexei Starovoitov]

On Mon, Nov 02, 2026 at 12:29 PM Jérémy Jean <Jeremy.Jean@xxxxxxxxxxxxxxxxx> wrote:
> BPF tokens allow a process to load BPF programs using CAP_NET_ADMIN in
> a userns, however, netns_bpf_link_create() does not check for
> CAP_NET_ADMIN in the target netns. Consequently, a token can be used
> to attach a BPF program to a netns it does not control.

That's not a gap. The prog FD and the netns FD are the permission.

pw-bot: cr