monadical/greywall
Archived
13
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

fix: skip network namespace when domain filtering proxy is active
Some checks failed
Build and test / Build (pull_request) Successful in 13s
Details
Build and test / Lint (pull_request) Failing after 35s
Details
Build and test / Test (Linux) (pull_request) Successful in 1m17s
Details

Browse Source 
Change --unshare-net skip logic to trigger whenever filterProxy is set,
not just for wildcard allow configs. The filtering proxy always listens
on host 127.0.0.1 and requires sandboxed processes to reach the host
network via env-var-based proxying. Also upgrade golangci-lint-action to v7.
This commit is contained in:
Jose B
2026-02-17 16:11:41 -05:00
parent ca80be7537
commit 1300cbacc9
2 changed files with 6 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
.gitea/workflows/main.yml
View File

@@ -43,7 +43,7 @@ jobs:
run: go mod download run: go mod download
- name: Lint - name: Lint
uses: golangci/golangci-lint-action@v6 uses: golangci/golangci-lint-action@v7
with: with:
install-mode: binary install-mode: binary
version: v2.1.6 version: v2.1.6

9
internal/sandbox/linux.go
View File

@@ -637,14 +637,15 @@ func WrapCommandLinuxWithOptions(cfg *config.Config, command string, proxyBridge
// Always use --unshare-net when available (network namespace isolation) // Always use --unshare-net when available (network namespace isolation)
// Inside the namespace, tun2socks will provide transparent proxy access. // Inside the namespace, tun2socks will provide transparent proxy access.
// Skip network namespace when domain filtering with wildcard allow is active // Skip network namespace when domain filtering proxy is active — the proxy
// (the filtering proxy handles domain enforcement via env vars). // listens on the host's 127.0.0.1 and uses env-var-based proxying, which
skipUnshareNet := filterProxy != nil && cfg != nil && cfg.Network.IsWildcardAllow() // requires the sandboxed process to reach the host network.
skipUnshareNet := filterProxy != nil
if features.CanUnshareNet && !skipUnshareNet { if features.CanUnshareNet && !skipUnshareNet {
bwrapArgs = append(bwrapArgs, "--unshare-net") // Network namespace isolation bwrapArgs = append(bwrapArgs, "--unshare-net") // Network namespace isolation
} else if opts.Debug { } else if opts.Debug {
if skipUnshareNet { if skipUnshareNet {
fmt.Fprintf(os.Stderr, "[greywall:linux] Skipping --unshare-net (wildcard allow with domain filtering)\n") fmt.Fprintf(os.Stderr, "[greywall:linux] Skipping --unshare-net (domain filtering proxy active)\n")
} else { } else {
fmt.Fprintf(os.Stderr, "[greywall:linux] Skipping --unshare-net (network namespace unavailable in this environment)\n") fmt.Fprintf(os.Stderr, "[greywall:linux] Skipping --unshare-net (network namespace unavailable in this environment)\n")
} }