[gaveezy]

Summary

Switch sandbox bypass detection from tailing the kernel ring buffer (dmesg, requires CAP_SYSLOG in the initial user namespace) to an nfnetlink_log (NFLOG) socket bound inside the workload netns (covered by namespaced CAP_NET_ADMIN), and drop CAP_SYSLOG from the Kubernetes, Docker, and Podman driver capability sets. This makes bypass detection work in user-namespaced pods (hostUsers: false), where a granted CAP_SYSLOG is a no-op because the kernel checks the ring buffer against the initial user namespace.

Related Issue

Closes #2382

Changes

• New bypass_monitor::nflog module in openshell-supervisor-process: minimal hand-rolled nfnetlink_log client over raw libc (zero new dependencies) — acked group bind + packet copy-mode config, and parsing of packet messages (prefix attribute, NFULA_UID, raw IPv4/IPv6 + TCP/UDP headers for dst/ports/proto).
• NetworkNamespace::install_bypass_rules binds the NFLOG socket first (on a short-lived setns thread, during privileged startup before supervisor seccomp hardening) and generates log prefix <p> group <N> rules on success; any failure falls back to the previous log ... flags skuid printk rules + dmesg monitor, and only that path enables the nf_log_all_netns sysctl.
• bypass_monitor::spawn takes the optional socket and prefers it; OCSF dual-emit / denial-aggregator / activity reporting is factored into a shared BypassReporter so both backends report identically. OCSF ConfigStateChange events record which backend was selected.
• CAP_SYSLOG removed from the K8s pod spec, Docker cap_add, and Podman cap_add; driver tests now assert its absence. Sidecar topology is unchanged (it has no bypass log listener).
• Docs: docs/kubernetes/topology.mdx capability table, Podman driver README capability rationale; e2e/rust/tests/user_namespaces.rs capability assertions updated.

Enforcement is unaffected — the nftables REJECT rules do not depend on log delivery; NFLOG only carries the detection/alerting signal. As a side benefit the sandbox no longer reads host-global kernel logs.

Testing

• mise run pre-commit passes
• mise run ci passes (lint, compile/type checks, tests)
• Unit tests added/updated — 14 new tests (netlink message layout, ack parsing, datagram/packet parsing incl. IPv6 and truncation fuzz, NFLOG vs ring-buffer rule generation); full crate suite (184 tests) run on Linux via Docker, cargo clippy (pedantic + nursery) clean for the Linux target
• E2E tests added/updated (if applicable) — existing user_namespaces.rs e2e updated; requesting test:e2e / test:e2e-kubernetes labels to exercise the live NFLOG path (rule install + packet delivery) on a real kernel

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)

Notes for reviewers

• The NFLOG group bind deliberately skips PF_BIND: group-targeted log group <N> statements deliver to the bound group directly; protocol-family binding is only required for legacy non-group logging. Called out in a code comment — the e2e run should confirm on a live kernel.
• Commits are not yet cryptographically signed, so copy-pr-bot will need a maintainer /ok to test.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

Thank you for your submission! We ask that you sign our Developer Certificate of Origin before we can accept your contribution. You can sign the DCO by adding a comment below using this text:

---

I have read the DCO document and I hereby sign the DCO.

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the DCO Assistant Lite bot.}

[gaveezy]

I have read the DCO document and I hereby sign the DCO.