Public bug reported:

# OpenSSH PermitTunnel regression: `ssh -w` fails with `EPERM` on
`TUNSETIFF`

## Environment

* Ubuntu 26.04 development
* openssh-server 1:10.2p1-2ubuntu3.2
* Linux 7.0.0-27-generic
* `PermitTunnel yes` enabled in `/etc/ssh/sshd_config`

## Summary

`ssh -w` fails even though:

* `PermitTunnel yes` is configured and active.
* `/dev/net/tun` exists.
* `ip tuntap add` works as root.
* `sshd` has `CAP_NET_ADMIN`.

The server attempts `TUNSETIFF` from the unprivileged session process,
which has no capabilities, causing `EPERM`.

## Steps to reproduce

Enable tunnel support:

```text
PermitTunnel yes
```

Restart sshd.

Verify:

```sh
sudo sshd -T | grep permittunnel
```

returns

```text
permittunnel yes
```

Verify the kernel supports TUN:

```sh
sudo ip tuntap add dev tun0 mode tun
sudo ip tuntap del dev tun0 mode tun
```

Both succeed.

Attempt tunnel forwarding:

```sh
sudo ssh -w 0:0 localhost
```

(or another host running the same sshd)

The client reports:

```text
Tunnel forwarding failed
```

## Server debug output

Running

```sh
sudo /usr/sbin/sshd -D -ddd -e -p 2222
```

shows

```text
permanently_set_uid: 1001/1001
server_input_channel_open: ctype [email protected]
openat("/dev/net/tun", O_RDWR) = 10
ioctl(TUNSETIFF, ...) = -1 EPERM (Operation not permitted)
sys_tun_open: failed to configure tunnel (mode 1): Operation not permitted
```

## Capabilities

The sshd session process executing the ioctl has no effective
capabilities:

```text
CapPrm: 0000000000000000
CapEff: 0000000000000000
CapBnd: 000001ffffffffff
```

The ssh service itself is not capability-restricted:

```text
CapabilityBoundingSet includes CAP_NET_ADMIN
PrivateDevices=no
```

## Expected behavior

The tunnel device should be configured successfully when `PermitTunnel
yes` is enabled.

## Actual behavior

The unprivileged session process performs `TUNSETIFF` after dropping all
capabilities, causing:

```text
EPERM
```

This appears to be a regression in the tunnel-opening path, since the
privileged monitor no longer performs the privileged ioctl.

** Affects: openssh (Ubuntu)
     Importance: Undecided
         Status: New

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2160695

Title:
  OpenSSH PermitTunnel regression: ssh -w fails with EPERM on TUNSETIFF

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/2160695/+subscriptions


-- 
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

Reply via email to