Enable generic sandbox kernel capabilities

doc/build.md

@@ -56,6 +56,12 @@ cgroup BPF. The build fails if `olddefconfig` drops any required option. The
 APK manifest records the `blkid` and `util-linux` tools used by the bootstrap
 plus the device helper's source and binary SHA-256 values.
 
+The platform configuration also enables Unix-domain sockets for local guest
+IPC and seccomp filters for workload syscall policies. Overlayfs does not
+unconditionally follow redirect metadata. These are kernel capabilities, not
+product-agent configuration; the same requirements are checked after
+`olddefconfig` and when verifying source and generated configurations.
+
 The native kernel build caches the verified and patched source under
 `.cache/linux`, uses `O=build/linux`, runs `olddefconfig`, exports the exact
 generated config as `build/vmlinux.config`, and fails if the Xen PVH note is

kernel/config-microvm

@@ -655,6 +655,7 @@ CONFIG_ARCH_WANT_OLD_COMPAT_IPC=y
 CONFIG_HAVE_ARCH_SECCOMP=y
 CONFIG_HAVE_ARCH_SECCOMP_FILTER=y
 CONFIG_SECCOMP=y
+CONFIG_SECCOMP_FILTER=y
 CONFIG_HAVE_ARCH_KSTACK_ERASE=y
 CONFIG_HAVE_STACKPROTECTOR=y
 CONFIG_STACKPROTECTOR=y
@@ -1692,6 +1693,7 @@ CONFIG_AUTOFS_FS=y
 CONFIG_FUSE_FS=y
 CONFIG_VIRTIO_FS=y
 CONFIG_OVERLAY_FS=y
+# CONFIG_OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW is not set
 
 #
 # Caches

scripts/nvx_tools/build.py

@@ -50,6 +50,9 @@
     "CONFIG_EXT4_FS=y",
     "CONFIG_MEMCG=y",
     "CONFIG_OVERLAY_FS=y",
+    "# CONFIG_OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW is not set",
+    "CONFIG_SECCOMP_FILTER=y",
+    "CONFIG_UNIX=y",
     "CONFIG_VIRTIO_BLK=y",
 )
 
@@ -88,7 +91,8 @@ def _assert_sandbox_kernel_config(path: Path) -> None:
     ]
     if missing:
         raise ScriptError(
-            "kernel configuration cannot run sandbox filesystems: " + ", ".join(missing)
+            "kernel configuration cannot support sandbox workloads: "
+            + ", ".join(missing)
         )
 
 

scripts/nvx_tools/release.py

@@ -27,6 +27,7 @@
     DEFAULT_KERNEL_SHA256,
     DEFAULT_KERNEL_URL,
     DEFAULT_KERNEL_VERSION,
+    REQUIRED_SANDBOX_KERNEL_CONFIG,
     DockerBuildConfig,
     build_docker_linux_source,
 )
@@ -618,6 +619,7 @@ def verify_source_tree() -> None:
         "CONFIG_HVC_XE9=y",
         "CONFIG_VIRTIO_FS=y",
         "CONFIG_FUSE_FS=y",
+        *REQUIRED_SANDBOX_KERNEL_CONFIG,
     ):
         if setting not in config.splitlines():
             raise ScriptError(f"{config_path} is missing {setting}")
@@ -630,7 +632,11 @@ def verify_source_tree() -> None:
     generated_config = artifact_path("vmlinux.config")
     if generated_config.is_file():
         generated = generated_config.read_text(encoding="utf-8").splitlines()
-        for setting in ("CONFIG_PVH=y", "CONFIG_HVC_XE9=y"):
+        for setting in (
+            "CONFIG_PVH=y",
+            "CONFIG_HVC_XE9=y",
+            *REQUIRED_SANDBOX_KERNEL_CONFIG,
+        ):
             if setting not in generated:
                 raise ScriptError(f"{generated_config} is missing {setting}")
     head = subprocess.run(

scripts/test_nvx_tools.py

@@ -831,15 +831,30 @@ def test_sandbox_kernel_config_requires_every_feature(self):
             )
             build._assert_sandbox_kernel_config(config)
 
-            config.write_text(
-                "\n".join(build.REQUIRED_SANDBOX_KERNEL_CONFIG[:-1]) + "\n",
-                encoding="utf-8",
-            )
-            with self.assertRaisesRegex(
-                common.ScriptError,
-                build.REQUIRED_SANDBOX_KERNEL_CONFIG[-1],
-            ):
-                build._assert_sandbox_kernel_config(config)
+            for missing in build.REQUIRED_SANDBOX_KERNEL_CONFIG:
+                with self.subTest(missing=missing):
+                    config.write_text(
+                        "\n".join(
+                            setting
+                            for setting in build.REQUIRED_SANDBOX_KERNEL_CONFIG
+                            if setting != missing
+                        )
+                        + "\n",
+                        encoding="utf-8",
+                    )
+                    with self.assertRaisesRegex(common.ScriptError, missing):
+                        build._assert_sandbox_kernel_config(config)
+
+    def test_checked_in_config_preserves_generic_sandbox_capabilities(self):
+        config = build.REPO_ROOT / "kernel" / "config-microvm"
+        build._assert_sandbox_kernel_config(config)
+        configured = config.read_text(encoding="utf-8").splitlines()
+        for setting in (
+            "CONFIG_SECCOMP_FILTER=y",
+            "CONFIG_UNIX=y",
+            "# CONFIG_OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW is not set",
+        ):
+            self.assertIn(setting, configured)
 
     def test_shared_status_kernel_config_is_required(self):
         with tempfile.TemporaryDirectory() as temporary: