[PATCH RFC v3 79/90] tun: use net_may() to create and attach to devices
From: Josef Bacik
Date: Thu Nov 05 2026 - 10:36:59 EST
Creating a tun or tap device requires CAP_NET_ADMIN. So does attaching to
a device unless the caller is its owner or a member of its group. Convert
both checks to NET_RIGHT_TUN.
SIOCGSKNS and TUNGETDEVNETNS return a file descriptor for a network
namespace. They keep the plain capability check.
No functional change.
Signed-off-by: Josef Bacik <josef@xxxxxxxxxxxxxx>
---
drivers/net/tun.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index dcec7311e601..0a2f864a253e 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -524,7 +524,7 @@ static inline bool tun_permitted(struct tun_struct *tun)
(!gid_valid(tun->group) || in_egroup_p(tun->group)))
return true;
- return ns_capable(net->user_ns, CAP_NET_ADMIN);
+ return net_may(net, NET_RIGHT_TUN);
}
static void tun_set_real_num_queues(struct tun_struct *tun)
@@ -2924,7 +2924,7 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
int queues = ifr->ifr_flags & IFF_MULTI_QUEUE ?
MAX_TAP_QUEUES : 1;
- if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
+ if (!net_may(net, NET_RIGHT_TUN))
return -EPERM;
err = security_tun_dev_create();
if (err < 0)
--
2.55.0