SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

nspawn: Add --restrict-address-families= option

Browse Source 
Add a new --restrict-address-families= command line option and
corresponding RestrictAddressFamilies= setting for .nspawn files to
restrict which socket address families may be used inside a container.

Many address families such as AF_VSOCK and AF_NETLINK are not
network-namespaced, so restricting access to them in containers
improves isolation. The option supports allowlist and denylist modes
(via ~ prefix), as well as "none" to block all families, matching the
semantics of RestrictAddressFamilies= in unit files.

The address family parsing logic is extracted into a shared
parse_address_families() helper in parse-helpers.c, which is now also
used by config_parse_address_families() in load-fragment.c.

This is currently opt-in. In a future version, the default will be
changed to restrict address families to AF_INET, AF_INET6 and AF_UNIX.
This commit is contained in:
Daan De Meyer
2026-04-13 11:14:11 +02:00
parent 4c9ce728e7
commit 4bbdc8a6a2
14 changed files with 300 additions and 164 deletions
Download Patch File Download Diff File Expand all files Collapse all files
man/systemd-nspawn.xml
+22
View File
@@ -1340,6 +1340,28 @@ After=sys-subsystem-net-devices-ens1.device</programlisting>
<xi:include href="version-info.xml" xpointer="v235"/></listitem>
</varlistentry>
<varlistentry>
<term><option>--restrict-address-families=</option></term>
<listitem><para>Restrict the socket address families accessible to the container. Takes a
space-separated list of address family names, such as <constant>AF_INET</constant>,
<constant>AF_INET6</constant> or <constant>AF_UNIX</constant>. When prefixed with
<literal>~</literal> the listed address families will be prohibited, otherwise they will be permitted
(allowlisted). Use the special value <literal>none</literal> to prohibit all address families. This
option may be specified more than once, in which case the configured lists are combined. If both a
positive and a negative list are configured, the negative list takes precedence over the positive
list.</para>
<para>Note that currently this option defaults to no restrictions, i.e. all address families are
accessible. In a future version of systemd, the default will be changed to restrict address families to
<constant>AF_INET</constant>, <constant>AF_INET6</constant> and <constant>AF_UNIX</constant>. Use
<option>--restrict-address-families=</option> (with an empty argument) or set
<varname>RestrictAddressFamilies=</varname> in a <filename>.nspawn</filename> file to opt out of
filtering explicitly.</para>
<xi:include href="version-info.xml" xpointer="v261"/></listitem>
</varlistentry>
<varlistentry>
<term><option>-Z</option></term>
<term><option>--selinux-context=</option></term>