[knorker]

> delete an existing nft rule that uses an nft anonymous set. And an example of the latter operation is an attempt to delete an element from that nft anonymous set after the set gets deleted

I'd be very interested to hear how this can be done by an unprivileged user.

Try to race set add/removals, sure, but if it depends on the set itself getting deleted, that seems… harder.

[0x006A]

on https://bugzilla.redhat.com/show_bug.cgi?id=2196105 a comment suggests that it might only be possible if you have "unprivileged user namespaces" enabled

[pizzalife]

>a comment suggests that it might only be possible if you have "unprivileged user namespaces" enabled

Which is the default on Ubuntu.

[chlorion]

It's the default on pretty much any modern Linux system!

[klooney]

From 2016- https://lwn.net/Articles/673597/

Andy Lutomirski described some concerns of his own:

> I consider the ability to use CLONE_NEWUSER to acquire CAP_NET_ADMIN over /any/ network namespace and to thus access the network configuration API to be a huge risk. For example, unprivileged users can program iptables. I'll eat my hat if there are no privilege escalations in there.

[withinboredom]

I hope he hasn't been eating his hat all these years. I hear that isn't good for the digestive system... /s