From: Florian Westphal on gitlab.com https://gitlab.com/cki-project/kernel-ark/-/merge_requests/3596#note_2296618422 redhat/configs/rhel/automotive/generic/CONFIG_NETFILTER_XT_MATCH_SOCKET | 1 + redhat/configs/rhel/automotive/generic/CONFIG_NFT_SOCKET | 1 + redhat/configs/rhel/automotive/generic/CONFIG_NF_SOCKET_IPV6 | 1 + These 3 changes are strange. None of these are network protocols, they can be used to check if an incoming packet has a socket in the current namespace (mostly used for transparent proxying w. policy routing), but the TPROXY feature remains on, which is contradictory; I'm not sure TPROXY is 100% functional without socket match. NFT_SOCKET also allows to do "accept packet if sending process is in cgroup "foo") and the like. Lastly, the commit message implies IPv6 is disabled, but I don't see a change for CONFIG_IPV6. If its going to be disabled, then CONFIG_NF_SOCKET_IPV6 change is not relevant because it depends on IPV6. If its going to remain enabled, I think that should be reflected in the commit message. I can't provide recommendations because I don't know the feature set that has to be supported, so its entirely possible that you could do CONFIG_NETFILTER=n. -- _______________________________________________ kernel mailing list -- kernel@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to kernel-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/kernel@xxxxxxxxxxxxxxxxxxxxxxx Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
