syscall tier: network "loopback" brings up lo, but seccomp refuses AF_INET sockets issue #73 closed: completed andymccall opened this 14 days ago · 0 comments

The syscall tier brings up lo in the job's own network namespace when the sandbox says network "loopback" (syscall.rs, loopback_up()), but its seccomp filter refuses socket() for every family but AF_UNIX regardless (seccomp(), EAFNOSUPPORT). So a job on narvi-1 cannot open a TCP socket on 127.0.0.1, and anything that tests a server over loopback cannot run there.

Seen in andymccall/x16-emulator run issue #1 (https://oxygenhub.io/andymccall/x16-emulator/flow/1): the retro-remote-debug-controller conformance suite, which runs the emulator with its HTTP control port on 127.0.0.1, skipped all 22 tests with

emulator control port never came up: <urlopen error [Errno 97] Address family not supported by protocol>

The same suite passes 22/22 run by hand on narvi, and on x86 in the microVM tier (retro-remote-debug-controller's own pipeline).

The job is in a new network namespace with only lo, so allowing AF_INET/AF_INET6 when the sandbox is network "loopback" would not reach past it. With network "isolated" the filter could stay as it is.

x16-emulator's pipeline runs a boot test in place of the suite for now; its .flow/pipeline.kdl notes why.