net: add --net-deny for default-allow egress with IP/CIDR/port denial#89

Merged

congwang-mk merged 24 commits into

mainfrom

Jun 8, 2026

Commits on Jun 5, 2026

net: add IpCidr type for --net-deny matching
congwang-mk
committed
net: parse --net-deny rules with CIDR and private token
congwang-mk
committed
net: reject empty icmp --net-deny body; document IPv6 bracket form
congwang-mk
committed
seccomp: add NetworkPolicy::DenyList variant
congwang-mk
committed
net: resolve --net-deny rules to per-protocol policies
congwang-mk
committed
sandbox: add --net-deny flag, builder method, and exclusivity check
congwang-mk
committed
sandbox: enforce --net-deny via DenyList policies in the supervisor
congwang-mk
committed
profile: support [network].deny and --net-deny round-trip
congwang-mk
committed
cli: reject --net-deny under --no-supervisor
congwang-mk
committed
net: enforce --net-deny at runtime (relax Landlock connect, trap on-behalf, allow UDP)
congwang-mk
committed
cli: wire --net-deny override into the builder and test exclusivity
congwang-mk
committed
net: make port optional and drop redundant :* in net rule grammar
congwang-mk
committed
landlock: test that --net-deny forces the TCP connect wildcard
congwang-mk
committed

Commits on Jun 7, 2026

Commits on Jun 8, 2026

net: add --net-deny-bind (default-allow bind denylist) across CLI/FFI/Python/Go
congwang-mk
committed