[Bubblewrap] Proxy-only egress does not restrict non-IP socket families (AF_VSOCK) #936

Relevant area(s)

Linux (Bubblewrap backend)

Brief description of your issue

Bubblewrap's proxy-only egress enforcement (schema 0.8+, added in #931) installs iptables and ip6tables rules that permit only loopback and the translated proxy endpoint, dropping everything else. Those rules filter AF_INET and AF_INET6 only.

An unprivileged workload inside the sandbox can still create AF_VSOCK sockets. On kernels and configurations where a vsock transport is reachable from a non-privileged guest context, this is a path to the host/hypervisor that never traverses the proxy and that no iptables rule can express. The sandbox's stated posture is "the proxy endpoint and nothing else", so a reachable non-IP socket family is a gap in that guarantee rather than an accepted limitation.

The same reasoning applies to any other non-IP address family that is reachable by default; AF_VSOCK is the concrete case identified.

Source: adversarial review of #931 (Medium). Deferred from that PR because the fix is a different enforcement mechanism (seccomp) from the one that PR introduces, not an extension of it.

Steps to reproduce

1. Run a Bubblewrap sandbox with schema 0.8.0-alpha and network.proxy configured, so proxy-only egress rules are installed.
2. From inside the sandbox, confirm the IP path is enforced: a direct TCP connect to an arbitrary public address is dropped, while the proxy endpoint is reachable.
3. From inside the sandbox, create an AF_VSOCK socket (socket(AF_VSOCK, SOCK_STREAM, 0)) and attempt to connect to a host context ID.
4. Observe that socket creation is permitted and that the attempt is not governed by any egress rule.

Expected behavior

Address families the backend cannot enforce policy over should not be reachable from a proxy-only sandbox. Either deny them with a seccomp filter on socket() for non-required families, or document and verify that the deployment's vsock configuration makes them unreachable. A regression test should attempt a vsock connect and assert it is refused.

Actual behavior

AF_VSOCK socket creation succeeds. Proxy-only egress covers only IPv4 and IPv6, so traffic over a non-IP family bypasses the proxy entirely without violating any installed rule.