Daan De Meyer 4bbdc8a6a2
nspawn: Add --restrict-address-families= option ...
Add a new --restrict-address-families= command line option and
corresponding RestrictAddressFamilies= setting for .nspawn files to
restrict which socket address families may be used inside a container.
Many address families such as AF_VSOCK and AF_NETLINK are not
network-namespaced, so restricting access to them in containers
improves isolation. The option supports allowlist and denylist modes
(via ~ prefix), as well as "none" to block all families, matching the
semantics of RestrictAddressFamilies= in unit files.
The address family parsing logic is extracted into a shared
parse_address_families() helper in parse-helpers.c, which is now also
used by config_parse_address_families() in load-fragment.c.
This is currently opt-in. In a future version, the default will be
changed to restrict address families to AF_INET, AF_INET6 and AF_UNIX.
2026-04-13 11:14:11 +02:00
2026-04-09 22:47:10 +02:00
2025-07-25 12:33:13 +02:00
2026-02-20 21:20:45 +01:00
2026-01-19 22:41:33 +09:00
2025-11-06 07:33:56 +09:00
2025-07-25 12:33:13 +02:00
2026-02-18 18:47:15 +09:00
2026-01-27 19:20:30 +01:00
2026-02-23 16:43:09 +00:00
2025-11-23 18:09:11 +01:00
2026-02-17 22:00:13 +01:00
2026-01-16 22:56:28 +09:00
2026-01-27 13:43:33 +01:00
2026-01-18 15:50:54 +09:00
2025-12-20 15:27:22 +01:00
2025-11-23 18:09:11 +01:00
2026-03-18 17:33:22 -04:00
2025-12-10 14:17:11 +09:00
2025-11-01 02:03:43 +09:00
2025-09-18 10:57:38 +01:00
2026-02-19 15:08:20 +01:00
2025-11-13 16:14:25 +01:00
2025-11-23 18:09:11 +01:00
2025-11-13 00:08:31 +01:00
2026-04-07 09:51:03 +02:00
2026-03-26 14:28:22 +01:00
2025-08-10 13:40:32 +02:00
2025-12-05 11:57:18 +01:00
2025-08-11 10:30:26 +02:00
2025-11-19 22:01:15 +01:00
2025-07-11 18:15:12 +02:00
2025-10-04 18:13:27 +02:00
2025-07-25 12:33:13 +02:00
2025-12-18 10:53:27 +01:00
2025-10-09 06:32:59 +02:00
2026-04-09 22:47:10 +02:00
2026-03-18 20:47:00 +00:00
2026-02-19 15:05:15 +01:00
2026-02-25 12:25:08 +01:00
2025-09-24 14:11:59 +01:00
2026-02-10 13:40:13 +00:00
2026-04-09 22:47:10 +02:00
2026-02-23 16:35:19 +00:00
2025-08-11 10:30:26 +02:00
2025-08-11 10:30:26 +02:00
2026-01-21 21:32:49 +01:00
2026-02-17 15:27:24 +01:00
2026-02-13 11:40:11 +01:00
2026-04-07 11:15:54 +02:00
2026-03-24 21:24:48 +01:00
2026-02-20 21:20:45 +01:00
2025-09-23 11:04:42 +01:00
2025-09-07 12:50:00 +09:00
2025-10-05 19:00:22 +09:00
2026-03-18 10:28:11 +00:00
2025-12-20 15:27:22 +01:00
2026-04-09 22:47:10 +02:00
2025-11-14 11:38:56 +01:00
2025-10-04 23:26:47 +02:00
2026-04-08 16:33:20 +02:00
2025-11-01 21:58:28 +01:00
2026-03-20 15:34:56 +01:00
2025-10-22 09:34:14 +02:00
2025-11-13 14:11:11 +01:00
2026-02-17 15:27:24 +01:00
2025-10-16 16:24:29 +02:00
2025-09-18 15:56:11 +02:00
2025-09-19 20:25:26 +09:00
2026-03-18 10:28:11 +00:00
2025-10-04 23:26:47 +02:00
2026-02-17 15:27:24 +01:00
2025-08-10 13:40:32 +02:00
2026-02-13 19:07:20 +01:00
2026-03-20 13:56:44 +00:00
2025-11-23 18:09:11 +01:00
2025-12-24 07:37:58 +01:00
2025-12-12 21:54:47 +09:00
2026-01-07 00:47:53 +01:00
2025-10-16 12:58:59 +01:00
2026-04-02 22:58:19 +09:00
2026-03-04 08:28:29 +01:00
2025-11-23 18:09:11 +01:00
2026-03-31 09:47:27 +01:00
2026-02-18 03:28:12 +09:00
2026-03-05 09:53:43 +01:00
2026-01-06 08:48:05 +09:00
2025-07-24 11:38:47 +02:00
2026-02-20 21:20:45 +01:00
2025-10-08 17:02:21 +02:00
2026-03-20 12:39:44 +01:00
2025-07-16 05:47:38 +09:00
2026-01-23 13:29:31 +01:00
2025-07-23 08:35:51 +09:00
2026-03-26 14:34:56 +01:00
2025-11-23 18:09:11 +01:00
2026-03-26 16:13:11 +01:00
2026-03-26 10:54:15 +01:00
2026-03-26 10:54:15 +01:00
2025-11-23 18:09:11 +01:00
2025-12-17 23:23:44 +00:00
2025-07-10 21:38:36 +02:00
2025-12-18 13:57:32 +01:00
2026-04-07 20:38:40 +02:00
2025-11-23 18:09:11 +01:00
2025-11-23 18:09:11 +01:00
2026-02-20 01:18:54 +09:00
2025-09-26 09:42:13 +02:00
2026-03-30 10:48:55 -04:00
2025-09-22 08:47:57 +02:00
2026-04-13 11:14:11 +02:00
2026-02-24 18:29:37 +01:00
2025-10-30 14:12:41 +00:00
2026-03-31 09:47:27 +01:00
2025-07-16 05:47:38 +09:00
2026-03-29 23:58:07 +02:00
2026-02-21 03:00:51 +09:00
2026-03-24 21:24:48 +01:00
2025-10-31 13:09:51 +01:00
2026-02-05 10:28:47 +01:00
2025-10-22 09:34:14 +02:00
2025-09-03 13:04:34 +02:00
2025-11-13 14:45:51 +01:00
2026-03-25 16:19:27 +01:00
2025-10-06 03:17:23 +09:00
2026-04-07 09:51:03 +02:00
2026-04-09 22:47:10 +02:00
2026-02-09 12:05:10 +00:00
2025-11-23 18:09:11 +01:00
2026-03-18 14:58:43 +01:00
2026-03-26 16:11:34 +01:00
2025-11-02 21:14:35 +01:00
2026-03-26 16:11:34 +01:00
2026-03-25 02:02:23 +01:00
2025-07-13 05:49:00 +09:00
2025-09-18 13:29:33 +02:00
2026-03-31 09:47:27 +01:00
2026-04-09 10:12:17 +02:00
2026-02-16 11:09:48 +01:00
2025-09-18 10:57:38 +01:00
2026-04-09 22:47:10 +02:00
2026-01-16 22:56:28 +09:00
2025-11-23 18:09:11 +01:00
2025-12-19 09:17:41 +00:00
2026-03-25 11:37:31 +01:00
2025-07-16 05:47:38 +09:00
2026-02-23 10:07:30 +01:00
2025-12-18 10:54:51 +01:00
2026-02-11 11:24:37 +01:00
2026-03-09 09:42:21 +09:00
2026-04-13 11:14:11 +02:00
2025-09-18 10:59:12 +01:00
2026-04-09 22:47:10 +02:00
2026-03-24 21:24:48 +01:00
2026-04-02 12:22:43 +01:00
2026-01-05 03:20:26 +09:00
2026-03-30 09:14:32 +01:00
2026-04-08 11:51:09 +01:00
2026-03-26 10:54:15 +01:00
2025-07-13 05:49:09 +09:00
2025-08-01 12:43:44 +01:00
2026-04-02 12:22:43 +01:00
2025-11-23 18:09:11 +01:00
2026-04-04 22:52:58 +02:00
2026-01-20 21:22:35 +01:00
2026-01-06 07:21:37 +09:00
2025-10-04 23:26:47 +02:00
2025-09-27 16:28:18 +03:00
2025-09-18 10:57:38 +01:00
2026-02-25 13:51:31 +00:00
2026-03-06 18:39:07 +01:00
2026-04-09 13:02:09 +02:00
2025-11-13 00:08:27 +01:00
2026-02-17 22:00:14 +01:00
2026-03-06 09:52:37 +09:00
Daan De Meyer
4bbdc8a6a2