Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

B-25 · Medium

planarian @ a924e09 · Spec v4.6 · snapshot main · all versions

§12d (Nov 3) counts a unit that could gain CAP_NET_ADMIN or CAP_NET_RAW as a network tool: its bounding set allows it and NoNewPrivileges= is unset, so a setuid or file-capability binary such as ping can grant it. The merged classifier (nix/module.nix, isNetworkToolUnchecked) reads the bounding set only for root units and never reads NoNewPrivileges=. A non-root unit that can gain the caps this way is not a tool: it is not ordered after netwatch, and its failure holds nothing even while it steers traffic: fails open

BreaksStatusMitigationCloses in
Correct (§12d not yet met)Open, temporary: closed by lane-nix’s acquirable-capabilities PR (with before/after tool counts and boot time)None until then; declare the unit with NoNewPrivileges=true or a bounding set without the network caps (tagging no longer makes a unit a tool, since #38)A

The guarantees it narrows

None: a process or availability row.