Re: [PATCH] bpf: netns: require CAP_NET_ADMIN for link targets

[Jérémy Jean]

On 2026-11-02 23:08, Alexei Starovoitov wrote:
> On Mon, Nov 02, 2026 at 12:29 PM Jérémy Jean 
> <Jeremy.Jean@xxxxxxxxxxxxxxxxx> wrote:
> > BPF tokens allow a process to load BPF programs using CAP_NET_ADMIN in
> > a userns, however, netns_bpf_link_create() does not check for
> > CAP_NET_ADMIN in the target netns. Consequently, a token can be used
> > to attach a BPF program to a netns it does not control.
>
> That's not a gap. The prog FD and the netns FD are the permission.
>
> pw-bot: cr

Thanks for the reply, yet I feel that I misunderstood something.
At first, it seemed to me that there was a security boundary issue,
but digging more with your feedback and Sashiko's one, I believe I was 
wrong,
that there is no issue and that this patch should instead simply be 
dropped.
Am I right? Or do you believe that there are still things to fix?

Regards,
Jérémy