Summary

Evolves socket-restrict from an AF_ALG-only block into a runtime-configurable socket-family / AF_NETLINK-protocol deny-list, populated from BPF maps. Defaults are intentionally conservative to avoid breaking common cloud-native workloads — anything that could regress Kubernetes networking (NETLINK_NETFILTER, AF_PACKET, IPsec sidecars, etc.) is opt-in.

Behavior change

Heads-up for users on the previous iteration of this branch: earlier revisions of this PR had AF_PACKET, AF_VSOCK, NETLINK_NETFILTER, NETLINK_XFRM, NETLINK_AUDIT, and NETLINK_KOBJECT_UEVENT in the default deny-list. They have been moved to opt-in to avoid breaking MetalLB, keepalived, kube-proxy IPVS, firecracker/kata, iptables-nft, nft-based CNIs (Istio CNI included), and IPsec sidecars. Final defaults are listed below.

The new defaults preserve the original AF_ALG / CVE-2026-31431 mitigation (existing event-type IDs EVENT_TYPE_SOCKET_AF_ALG_{CREATE,BIND} are kept) and additionally deny only niche/legacy families with no realistic cloud-native use.

Default deny-list (out of the box)

Opt-in (set via flags)

Recommended rollout (audit → enforce)

1. Audit, defaults only. Deploy with --enforce=false and the default --socket-deny-families. Watch for socket_family_denied_create / _bind events. The defaults should produce ~zero events on a normal Kubernetes data plane.
2. Audit, broaden. Once defaults are clean, opt-in additional families/protocols incrementally — e.g. --socket-deny-families=AF_ALG,…,AF_VSOCK for clusters with no vsock workloads, or --socket-deny-netlink-protocols=NETLINK_NETFILTER for clusters using iptables-legacy / pure IPVS. Keep --enforce=false. Validate against your specific data plane (CNI, kube-proxy mode, service-mesh CNI, MetalLB, IPsec sidecars).
3. Enforce. When the audit log is clean for the target families/protocols across all production workload shapes for at least a release cycle, flip --enforce=true.

What's in this PR

BPF

• gadgets/socket-restrict/program.bpf.c — replaces the hard-coded switch with two BPF maps (denied_families keyed by __u16, denied_netlink_protocols keyed by __u32). Lookups happen in lsm/socket_create and lsm/socket_bind.
• Bind-path micro-optimization: sk_protocol is only read via BPF_CORE_READ_BITFIELD_PROBED when family == AF_NETLINK and the family is not already denied. Non-netlink binds skip the field-read entirely.

Userspace / wiring

• New internal/operators/socket_restrict.go — operator that populates map/denied_families and map/denied_netlink_protocols on each gadget's init (no-op when those maps are absent, i.e. for the other 4 gadgets).
• Name ↔ number tables for socket families (AF_*) and netlink protocols (NETLINK_*); flags accept symbolic names or decimal numbers, case-insensitive, with whitespace-trimming and dedup.
• New CLI flags --socket-deny-families (conservative default above) and --socket-deny-netlink-protocols (empty default).
• Existing event-type IDs (EVENT_TYPE_SOCKET_AF_ALG_{CREATE,BIND} = 11/12 and EVENT_TYPE_SOCKET_FAMILY_DENIED_{CREATE,BIND} = 14/15) and the family / protocol event fields are preserved.

Tests

• internal/operators/socket_restrict_test.go — covers parsing (mixed names/numbers, case insensitivity, dedup, errors).
• cmd/micromize/root_test.go — extended TestBuildDisabledSet with socket-restrict.
• internal/gadget/registry_test.go — registry coverage for all 5 gadgets.
• tests/integration/probes/af_vsock/main.go + tests/integration/cases/11_af_vsock_audit_mode.sh — opt-in AF_VSOCK + --enforce=false exercise (probe must observe socket() succeeding while the gadget emits an event).

Docs

• gadgets/socket-restrict/README.md rewritten with the new defaults, per-flag compatibility caveats, and the audit → enforce rollout.
• Top-level README.md updated: bullet reflects conservative defaults and points at the gadget README; new CLI flags added to the flags table.

Out of scope (future PRs)

• Allow-list ("subtractive") flags to remove individual entries from the default deny-list without specifying the full list.
• Per-namespace / per-pod deny-list overrides.
• True per-family audit vs enforce modes (today --enforce is global).