D01-CJ: Yes
Rationale
The official non-root method 1 provisions a user-owned persistent TUN interface and configures its address/MTU administratively, then runs cjdroute as that normal user. This supports routine Linux operation without elevated networking capabilities. Method 2, which grants CAP_NET_ADMIN/CAP_NET_RAW, is not this witness.
Assessment method
Specification/source/dependency analysis; no new runtime execution
Source context
Primary documentation and explicitly selected composition; documentary review 2026-10-15
Outstanding qualification
Privileged TUN preparation is required again after restart as documented. Keep method 1 and the selected UDP peer configuration; no new execution.