Public bug reported: # OpenSSH PermitTunnel regression: `ssh -w` fails with `EPERM` on `TUNSETIFF`
## Environment * Ubuntu 26.04 development * openssh-server 1:10.2p1-2ubuntu3.2 * Linux 7.0.0-27-generic * `PermitTunnel yes` enabled in `/etc/ssh/sshd_config` ## Summary `ssh -w` fails even though: * `PermitTunnel yes` is configured and active. * `/dev/net/tun` exists. * `ip tuntap add` works as root. * `sshd` has `CAP_NET_ADMIN`. The server attempts `TUNSETIFF` from the unprivileged session process, which has no capabilities, causing `EPERM`. ## Steps to reproduce Enable tunnel support: ```text PermitTunnel yes ``` Restart sshd. Verify: ```sh sudo sshd -T | grep permittunnel ``` returns ```text permittunnel yes ``` Verify the kernel supports TUN: ```sh sudo ip tuntap add dev tun0 mode tun sudo ip tuntap del dev tun0 mode tun ``` Both succeed. Attempt tunnel forwarding: ```sh sudo ssh -w 0:0 localhost ``` (or another host running the same sshd) The client reports: ```text Tunnel forwarding failed ``` ## Server debug output Running ```sh sudo /usr/sbin/sshd -D -ddd -e -p 2222 ``` shows ```text permanently_set_uid: 1001/1001 server_input_channel_open: ctype [email protected] openat("/dev/net/tun", O_RDWR) = 10 ioctl(TUNSETIFF, ...) = -1 EPERM (Operation not permitted) sys_tun_open: failed to configure tunnel (mode 1): Operation not permitted ``` ## Capabilities The sshd session process executing the ioctl has no effective capabilities: ```text CapPrm: 0000000000000000 CapEff: 0000000000000000 CapBnd: 000001ffffffffff ``` The ssh service itself is not capability-restricted: ```text CapabilityBoundingSet includes CAP_NET_ADMIN PrivateDevices=no ``` ## Expected behavior The tunnel device should be configured successfully when `PermitTunnel yes` is enabled. ## Actual behavior The unprivileged session process performs `TUNSETIFF` after dropping all capabilities, causing: ```text EPERM ``` This appears to be a regression in the tunnel-opening path, since the privileged monitor no longer performs the privileged ioctl. ** Affects: openssh (Ubuntu) Importance: Undecided Status: New -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2160695 Title: OpenSSH PermitTunnel regression: ssh -w fails with EPERM on TUNSETIFF To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/2160695/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
