mirror of
https://github.com/linuxkit/linuxkit.git
synced 2026-04-04 22:49:40 +00:00
1a23054800
support SPI in container environment (introduced Linux 4.12 2017-06-02). Abstraction define interface EP for CAN module in containered environment. This namespace is available and introduced with Linux Kernel 4.12 by M. Kicherer and later O. Hartkopp, to allow containers bridging such device. @see linux-kernel/net/can@fc4c581 Although KSPP did not explicilty noted `CAN` as secure kernel flag, this would aim to bring such conclusion. As for security concerns, CAN protocol did not yield any user-land or host-level vulnerabilities since introduced as SocketCAN module in Linux Kernel. Lower-layer [protocol] standards is not secured by default since applications are supposed to implement their own security mechanism. This global abstraction currently supports CAN raw, proc and af_can codes. Does not support GW and BCM. Namespace uses _NEWNET on pseudo-file system. Allows modprobe to environment, works by recv `pnet` for the given interface. Signed-off-by: Halis Duraki <duraki@linuxmail.org>
Projects
We aim to provide a set of open spaces for collaboration to help move projects towards production. Projects should usually
at a minimum provide a README of how to get started using the project with Moby, and a roadmap document explaining what
the aims are and how to contribute. Most projects will probably provide a way to run the project in a custom Moby build
in its current state, which ideally will be integrated in the Moby CI so there are checks that it builds and runs. Over
time we hope that many projects will graduate into the recommended production defaults, but other projects may remain as
ongoing projects, such as kernel hardening.
If you want to create a project, please submit a pull request to create a new directory here.
Current projects
- Kernel Self Protection Project enhancements
- Mirage SDK privilege separation for userspace services
- OKernel intra-kernel protection using EPT (HPE)
- eBPF iovisor eBPF tools
- Landlock LSM programmatic access control
- Clear Containers Clear Containers image
- Logging Experimental logging tools
- IMA-namespace patches for supporting per-mount-namespace IMA policies
- shiftfs is a filesystem for mapping mountpoints across user namespaces
- Memorizer is a tool to trace intra-kernel memory operations.
Current projects not yet documented
- VMWare support (VMWare)
- ARM port and secure boot integration (ARM)
Completed projects
aws/: AWS support was merged into mainline in #1964.wireguard/: WireGuard is now part of the default LinuxKit kernel and package set.kubernetes/: Has been moved to https://github.com/linuxkit/kubernetes.