diff -drupN a/drivers/net/tun.c b/drivers/net/tun.c
--- a/drivers/net/tun.c	2018-08-06 17:23:04.000000000 +0300
+++ b/drivers/net/tun.c	2022-06-12 05:28:14.000000000 +0300
@@ -2019,6 +2019,12 @@ static long __tun_chr_ioctl(struct file
 	int le;
 	int ret;
 
+#ifdef CONFIG_ANDROID_PARANOID_NETWORK
+	if (cmd != TUNGETIFF && !capable(CAP_NET_ADMIN)) {
+		return -EPERM;
+	}
+#endif
+
 	if (cmd == TUNSETIFF || cmd == TUNSETQUEUE || _IOC_TYPE(cmd) == 0x89) {
 		if (copy_from_user(&ifr, argp, ifreq_len))
 			return -EFAULT;