dhavalkapil-oai 1bda886113 Enforce Linux seccomp restrictions for x32 syscalls (#61206) ...

## Why

The x32 ABI shares the x86-64 audit architecture, so the architecture check alone does not enforce syscall restrictions for x32 callers.

## What changed

Apply existing syscall denials and socket-family conditions to x32 syscall numbers on x86-64, including separate x32 numbers and legacy aliases supported before Linux 5.4.

## Testing

Add probes across all three network seccomp modes to verify that restricted native and x32 calls return `EPERM`, allowed calls preserve their behavior, and socket-family restrictions apply to both ABIs.

GitOrigin-RevId: fa38138d6b6c7b26dfafd6c931880ee1265a1b94

2026-11-12 23:53:14 +00:00

..

bazel_bwrap.rs

Add a bubblewrap backend for sandbox integrity checks (#51840)

2026-10-07 21:50:48 +00:00

bundled_bwrap_tests.rs

Move Linux sandbox unit tests into separate files (#55620)

2026-10-20 16:25:02 +00:00

bundled_bwrap.rs

Move Linux sandbox unit tests into separate files (#55620)

2026-10-20 16:25:02 +00:00

bwrap_tests.rs

Stabilize the unreadable-glob traversal error test (#59736)

2026-11-05 20:56:09 +00:00

bwrap_wslg_tests.rs

Expand Linux sandbox deny globs in process (#59711)

2026-11-05 17:56:59 +00:00

bwrap.rs

Expand Linux sandbox deny globs in process (#59711)

2026-11-05 17:56:59 +00:00

daemon_mounts_tests.rs

Handle Btrfs device mismatches when masking daemon sockets (#47968)

2026-09-24 23:35:42 +00:00

daemon_mounts.rs

Handle Btrfs device mismatches when masking daemon sockets (#47968)

2026-09-24 23:35:42 +00:00

exec_util_tests.rs

Move Linux sandbox unit tests into separate files (#55620)

2026-10-20 16:25:02 +00:00

exec_util.rs

Move Linux sandbox unit tests into separate files (#55620)

2026-10-20 16:25:02 +00:00

fd_mount_tests.rs

Make sandbox mount cleanup tests tolerate file descriptor reuse (#56454)

2026-10-23 12:08:11 +00:00

fd_mount.rs

Support FD mounts with older system Bubblewrap versions (#39404)

2026-08-19 04:06:50 +00:00

launcher_tests.rs

Move Linux sandbox unit tests into separate files (#55620)

2026-10-20 16:25:02 +00:00

launcher.rs

Move Linux sandbox unit tests into separate files (#55620)

2026-10-20 16:25:02 +00:00

lib.rs

Add policy-checked TCP upstream tunneling for SOCKS (#60523)

2026-11-10 04:43:24 +00:00

linux_run_main_tests.rs

Remove obsolete protected-path monitoring from the Linux sandbox (#54445)

2026-10-15 23:58:30 +00:00

linux_run_main.rs

Add policy-checked TCP upstream tunneling for SOCKS (#60523)

2026-11-10 04:43:24 +00:00

main.rs

fix: overhaul how we spawn commands under seccomp/landlock on Linux (#1086)

2025-05-23 11:37:07 -07:00

managed_tcp_dns.rs

Add policy-checked TCP upstream tunneling for SOCKS (#60523)

2026-11-10 04:43:24 +00:00

managed_tcp_relay_tests.rs

Add policy-checked TCP upstream tunneling for SOCKS (#60523)

2026-11-10 04:43:24 +00:00

managed_tcp_tests.rs

Add policy-checked TCP upstream tunneling for SOCKS (#60523)

2026-11-10 04:43:24 +00:00

managed_tcp.rs

Add policy-checked TCP upstream tunneling for SOCKS (#60523)

2026-11-10 04:43:24 +00:00

proxy_lifecycle_tests.rs

Harden managed proxy listener handoff (#40999)

2026-08-26 23:41:18 +00:00

proxy_lifecycle.rs

Harden managed proxy listener handoff (#40999)

2026-08-26 23:41:18 +00:00

proxy_routing_tests.rs

Add policy-checked TCP upstream tunneling for SOCKS (#60523)

2026-11-10 04:43:24 +00:00

proxy_routing.rs

Add policy-checked TCP upstream tunneling for SOCKS (#60523)

2026-11-10 04:43:24 +00:00

seccomp_tests.rs

Enforce Linux seccomp restrictions for x32 syscalls (#61206)

2026-11-12 23:53:14 +00:00

seccomp.rs

Enforce Linux seccomp restrictions for x32 syscalls (#61206)

2026-11-12 23:53:14 +00:00

wslg_tests.rs

Hide WSLg's duplicate root in restricted Linux sandboxes (#45837)

2026-09-16 02:17:36 +00:00

wslg.rs

Hide WSLg's duplicate root in restricted Linux sandboxes (#45837)

2026-09-16 02:17:36 +00:00