2 ms·
At least in the k8s setup I looked at the dirtyfrag were filtered (by default). "XFRM SA registration requires CAP_NET_ADMIN".
by YZF 5mo ago
At least in the k8s setup I looked at the dirtyfrag were filtered (by default).
"XFRM SA registration requires CAP_NET_ADMIN".
- fulafel 5mo agoRight, so it blocked the first part of the chain. Which normally uses unprivilgeed network namespace to dp net admin inside that. I had been thinking of a RxRPC AF block for the second part of the chain which seems rarer. Systemd seems to have this setting for units since 2011: > The setting RestrictAddressFamilies aims to restrict what socket address families can be used. When using it, the default is that it is used as an allow-list and define what address families can be used. > Example > A common combination might look like this. [Service] SystemCallArchitectures=native RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX