dhavalkapil-oai 7eaaee4270 Block request_key in Linux network sandbox filters (#61256) ...

## Why

`request_key` can invoke host helpers that make network requests outside the sandbox's network namespace and proxy policy.

## What changed

Deny `request_key` with `EPERM` in the `Restricted` and `ProxyRouted` seccomp modes, leaving `VmSocketRestricted` unchanged.

## Testing

Add a threaded syscall regression test covering all three modes. Install a baseline filter returning `ENOSYS` so the probe cannot invoke host helpers and inherited `EPERM` filters cannot hide regressions.

GitOrigin-RevId: 196de45ea4da3e40d2f2264ff88ed10d3e5bcdda

2026-11-13 04:50:31 +00:00

..

bazel_bwrap.rs

Add a bubblewrap backend for sandbox integrity checks (#51840)

2026-10-07 21:50:48 +00:00

bundled_bwrap_tests.rs

Move Linux sandbox unit tests into separate files (#55620)

2026-10-20 16:25:02 +00:00

bundled_bwrap.rs

Move Linux sandbox unit tests into separate files (#55620)

2026-10-20 16:25:02 +00:00

bwrap_tests.rs

Stabilize the unreadable-glob traversal error test (#59736)

2026-11-05 20:56:09 +00:00

bwrap_wslg_tests.rs

Expand Linux sandbox deny globs in process (#59711)

2026-11-05 17:56:59 +00:00

bwrap.rs

Expand Linux sandbox deny globs in process (#59711)

2026-11-05 17:56:59 +00:00

daemon_mounts_tests.rs

Handle Btrfs device mismatches when masking daemon sockets (#47968)

2026-09-24 23:35:42 +00:00

daemon_mounts.rs

Handle Btrfs device mismatches when masking daemon sockets (#47968)

2026-09-24 23:35:42 +00:00

exec_util_tests.rs

Move Linux sandbox unit tests into separate files (#55620)

2026-10-20 16:25:02 +00:00

exec_util.rs

Move Linux sandbox unit tests into separate files (#55620)

2026-10-20 16:25:02 +00:00

fd_mount_tests.rs

Make sandbox mount cleanup tests tolerate file descriptor reuse (#56454)

2026-10-23 12:08:11 +00:00

fd_mount.rs

Support FD mounts with older system Bubblewrap versions (#39404)

2026-08-19 04:06:50 +00:00

launcher_tests.rs

Move Linux sandbox unit tests into separate files (#55620)

2026-10-20 16:25:02 +00:00

launcher.rs

Move Linux sandbox unit tests into separate files (#55620)

2026-10-20 16:25:02 +00:00

lib.rs

Add policy-checked TCP upstream tunneling for SOCKS (#60523)

2026-11-10 04:43:24 +00:00

linux_run_main_tests.rs

Remove obsolete protected-path monitoring from the Linux sandbox (#54445)

2026-10-15 23:58:30 +00:00

linux_run_main.rs

Add policy-checked TCP upstream tunneling for SOCKS (#60523)

2026-11-10 04:43:24 +00:00

main.rs

fix: overhaul how we spawn commands under seccomp/landlock on Linux (#1086)

2025-05-23 11:37:07 -07:00

managed_tcp_dns.rs

Add policy-checked TCP upstream tunneling for SOCKS (#60523)

2026-11-10 04:43:24 +00:00

managed_tcp_relay_tests.rs

Add policy-checked TCP upstream tunneling for SOCKS (#60523)

2026-11-10 04:43:24 +00:00

managed_tcp_tests.rs

Add policy-checked TCP upstream tunneling for SOCKS (#60523)

2026-11-10 04:43:24 +00:00

managed_tcp.rs

Add policy-checked TCP upstream tunneling for SOCKS (#60523)

2026-11-10 04:43:24 +00:00

proxy_lifecycle_tests.rs

Harden managed proxy listener handoff (#40999)

2026-08-26 23:41:18 +00:00

proxy_lifecycle.rs

Harden managed proxy listener handoff (#40999)

2026-08-26 23:41:18 +00:00

proxy_routing_tests.rs

Add policy-checked TCP upstream tunneling for SOCKS (#60523)

2026-11-10 04:43:24 +00:00

proxy_routing.rs

Add policy-checked TCP upstream tunneling for SOCKS (#60523)

2026-11-10 04:43:24 +00:00

seccomp_tests.rs

Block request_key in Linux network sandbox filters (#61256)

2026-11-13 04:50:31 +00:00

seccomp.rs

Block request_key in Linux network sandbox filters (#61256)

2026-11-13 04:50:31 +00:00

wslg_tests.rs

Hide WSLg's duplicate root in restricted Linux sandboxes (#45837)

2026-09-16 02:17:36 +00:00

wslg.rs

Hide WSLg's duplicate root in restricted Linux sandboxes (#45837)

2026-09-16 02:17:36 +00:00