Files
systemd/man
Daan De Meyer 4bbdc8a6a2 nspawn: Add --restrict-address-families= option
Add a new --restrict-address-families= command line option and
corresponding RestrictAddressFamilies= setting for .nspawn files to
restrict which socket address families may be used inside a container.

Many address families such as AF_VSOCK and AF_NETLINK are not
network-namespaced, so restricting access to them in containers
improves isolation. The option supports allowlist and denylist modes
(via ~ prefix), as well as "none" to block all families, matching the
semantics of RestrictAddressFamilies= in unit files.

The address family parsing logic is extracted into a shared
parse_address_families() helper in parse-helpers.c, which is now also
used by config_parse_address_families() in load-fragment.c.

This is currently opt-in. In a future version, the default will be
changed to restrict address families to AF_INET, AF_INET6 and AF_UNIX.
2026-04-13 11:14:11 +02:00
..
2026-04-09 22:47:10 +02:00
2024-12-25 17:00:31 +01:00
2024-11-24 01:11:42 +09:00
2025-09-18 10:57:38 +01:00
2025-08-10 13:40:32 +02:00
2025-08-11 10:30:26 +02:00
2025-10-04 18:13:27 +02:00
2025-08-11 10:30:26 +02:00
2025-08-11 10:30:26 +02:00
2026-01-21 21:32:49 +01:00
2024-12-25 17:00:31 +01:00
2024-12-25 17:00:31 +01:00
2024-12-25 17:00:31 +01:00
2025-08-10 13:40:32 +02:00
2024-12-25 17:00:31 +01:00
2026-01-06 08:48:05 +09:00
2026-02-20 01:18:54 +09:00
2026-02-21 03:00:51 +09:00
2026-03-18 14:58:43 +01:00
2025-07-16 05:47:38 +09:00
…
2024-11-06 19:06:40 +09:00
2025-09-18 10:57:38 +01:00
…