D01-BA: Yes
Rationale
A QEMU/KVM Debian 13 guest with stock Linux 6.12.101+deb13-amd64 and batman-adv 2024.2 exchanged 16 native Ethernet requests and replies between two bat0 endpoints over a veth link. BATMAN_IV was explicitly selected and independently read back through generic netlink at both endpoints. Before all payload traffic, both application processes permanently dropped to UID/GID 65534, cleared supplementary groups, enabled no_new_privs and verified zero effective/permitted/inherited/ambient capabilities. Both denied root reacquisition and creation of another raw socket, while sending and receiving through their provisioned descriptors. No IP/UDP payload or continuing privileged userspace forwarding helper was used.
Assessment method
Sixteen bidirectional request/reply transactions after permanent privilege drop; kernel algorithm readback and negative privilege controls
Source context
Executed QEMU/KVM native Ethernet experiment; Linux and packet socket documentation
Outstanding qualification
Privileged installation, kernel module loading, namespace/interface provisioning and AF_PACKET socket creation are required and disclosed. The Yes concerns routine operation on the provisioned endpoint, not permissionless socket creation or a kernel-module-free stack. The retained socket is an explicitly delegated networking resource. This single-guest, two-namespace, one-link experiment does not establish multihop/radio behavior, bonding, mobility, performance, isolation against malicious raw-frame applications or full-profile interoperability. Small frames were used; the 1500-byte underlay MTU warning is retained and large-frame behavior is unqualified. Initial module-parameter and ip-output diagnostic failures occurred before traffic; a later capture attempt produced no usable result. Only the retained final PASS is credited.
Public sources
- https://docs.kernel.org/6.12/networking/batman-adv.html
- https://man7.org/linux/man-pages/man7/packet.7.html
Editorial evidence references
The following identifiers refer to research records not included in this public package; they are not public links.
- round286-runtime.json
- round286_guest.py
- round286-sources.json