Repository navigation

Refuse AF_PACKET - #1457

Open

Darren Hoehna (dhoehna) wants to merge 13 commits into

mainfrom

user/dahoehna/lxc-afpacket-seccomp

Open

Refuse AF_PACKET#1457
Darren Hoehna (dhoehna) wants to merge 13 commits into
mainfrom
user/dahoehna/lxc-afpacket-seccomp

Commits on Oct 8, 2026
- Refuse AF_PACKET sockets in filtered LXC containers
  
  Darren Hoehna (dhoehna)
  and
  Copilot
  committed
  4492e36
- simplifying main
  Darren Hoehna (dhoehna)
  committed
  f2aa888
Commits on Oct 9, 2026
- Finishing up seccomp
  Darren Hoehna (dhoehna)
  committed
  a7b725e
- Fixing up some AI comments
  Darren Hoehna (dhoehna)
  committed
  c6a9521
- Restore hyperlight setup on non-Linux targets
  
  Darren Hoehna (dhoehna)
  and
  Copilot
  committed
  b2949c6
- Prove the AF_PACKET refusal with a test
  
  Darren Hoehna (dhoehna)
  and
  Copilot
  committed
  f9e9014
- Restore the error reporting the main rewrite dropped
  
  Darren Hoehna (dhoehna)
  and
  Copilot
  committed
  0aa18c8
- Restore the ICMP precondition to the egress test
  
  Darren Hoehna (dhoehna)
  and
  Copilot
  committed
  1c9893d
- Install the signal watchdog just before the container run
  
  Darren Hoehna (dhoehna)
  and
  Copilot
  committed
  7c9b02f
Commits on Oct 13, 2026
- Refuse legacy SOCK_PACKET, AF_XDP, and io_uring under the firewall
  
  Darren Hoehna (dhoehna)
  and
  Copilot
  committed
  ebfb45d
- Shorten the refuse_packet_sockets doc comment
  
  Darren Hoehna (dhoehna)
  and
  Copilot
  committed
  3150b36
- Group SECOND_ARGUMENT with the other seccomp_data offsets
  
  Darren Hoehna (dhoehna)
  and
  Copilot
  committed
  ccc6b1b
- Say what the ENOSYS refusal means instead of guessing at callers
  
  Darren Hoehna (dhoehna)
  and
  Copilot
  committed
  076376b

Commits

Commits on Oct 8, 2026

Commits on Oct 9, 2026

Commits on Oct 13, 2026