feat(network): add open_port_range and fix Linux ProxyOnly semantics#1262
Open
SequeI wants to merge 3 commits into
Open
feat(network): add open_port_range and fix Linux ProxyOnly semantics#1262SequeI wants to merge 3 commits into
SequeI wants to merge 3 commits into
Conversation
Contributor
PR Review SummarySize
Affected crates
Blast radius — ModerateThis PR touches: source code,documentation Updated automatically on each push to this PR. |
- ProxyOnly on Linux now always uses seccomp-notify regardless of Landlock ABI; Landlock TCP rules have no IP component and cannot enforce loopback-only - Add open_port_range to profiles and CapabilitySet for localhost IPC port ranges; macOS expands ≤256 ports to individual Seatbelt rules, wider ranges collapse to localhost:* with a warning; Linux expands to individual Landlock rules in both block-net and proxy mode - Add open_port=0 wildcard in proxy mode: allows any loopback connect/bind without knowing the port at profile-write time (fixes ephemeral port use cases like Testcontainers and Maven Surefire) - open_port=0 in block-net mode on Linux errors at startup (no supervisor) - Document all network mode and port behaviour including platform differences Signed-off-by: Aleksy Siek <aleksy@alwaysfurther.ai>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Linked Issue
Closes #1101
Closes #611
Summary
Test Plan
Checklist
CHANGELOG.mdif needed