Drew Newberry f7e91a32da fix(sandbox): allowlist workload socket families ...

The workload seccomp filter denied only AF_PACKET, AF_BLUETOOTH, and
AF_VSOCK, and the broker continued socket() for every non-INET family.
Several protocol families, including AF_RXRPC, AF_SMC, and AF_KCM, carry
traffic over kernel-owned sockets that the broker never creates and that
are not bound to loopback.

Allow only AF_UNIX, AF_NETLINK (still limited to NETLINK_ROUTE), and the
brokered AF_INET/AF_INET6 families, and restrict socketpair(2) to
AF_UNIX. Both decisions use the scalar domain argument. The broker
independently refuses non-INET families other than AF_UNIX and
AF_NETLINK with EAFNOSUPPORT.

Signed-off-by: Drew Newberry <anewberry@nvidia.com>

2026-10-02 18:13:49 -07:00

..

best-practices.mdx

fix(sandbox): allowlist workload socket families

2026-10-02 18:13:49 -07:00

verify-image-contents.mdx

docs: keep page URLs aligned with file paths (#3713)

2026-09-28 02:08:54 +00:00