Daan De Meyer
4bbdc8a6a2
Add a new --restrict-address-families= command line option and corresponding RestrictAddressFamilies= setting for .nspawn files to restrict which socket address families may be used inside a container. Many address families such as AF_VSOCK and AF_NETLINK are not network-namespaced, so restricting access to them in containers improves isolation. The option supports allowlist and denylist modes (via ~ prefix), as well as "none" to block all families, matching the semantics of RestrictAddressFamilies= in unit files. The address family parsing logic is extracted into a shared parse_address_families() helper in parse-helpers.c, which is now also used by config_parse_address_families() in load-fragment.c. This is currently opt-in. In a future version, the default will be changed to restrict address families to AF_INET, AF_INET6 and AF_UNIX.
12 lines
348 B
C
12 lines
348 B
C
/* SPDX-License-Identifier: LGPL-2.1-or-later */
|
|
#pragma once
|
|
|
|
#include "shared-forward.h"
|
|
|
|
int setup_seccomp(
|
|
uint64_t cap_list_retain,
|
|
char **syscall_allow_list,
|
|
char **syscall_deny_list,
|
|
Set *restrict_address_families,
|
|
bool restrict_address_families_is_allowlist);
|