D01-IP: Yes
Rationale
In an isolated Debian 13.6 guest, Linux 6.12.101+deb13-amd64, two peers per address family created native protocol-253 raw sockets during privileged setup, then permanently changed all UID/GID values to 65534, cleared supplementary groups and set no_new_privs. Effective, permitted, inherited and ambient capabilities were zero. Both root reacquisition and creation of a fresh raw socket were rejected, while request/reply exchange through the retained sockets passed for IPv4 and IPv6. The parent only synchronized readiness; it neither opened nor used a network socket. This closes the previous sandbox-only prerequisite failure with an actual bounded runtime witness.
Assessment method
Executed isolated QEMU/KVM guest experiment; no external network interface
Source context
Evidence checked 2026-10-15; versions and hashes in round234-sources.json
Outstanding qualification
Privileged socket creation is required once and is disclosed. The experiment used local loopback, not an external NIC, routed multi-host network, BGP or multicast administration; it is not a performance test. A complete deployment must still provision routes/interfaces and preserve its security policy. Native IP datagrams were used, with no added TCP/UDP transport. Signed result digest fd2d6f7e538c4f48790bbf13f5444bd56451f08b3018978088febc7e686e0b4a.
Public sources
Editorial evidence references
The following identifiers refer to research records not included in this public package; they are not public links.
- round234-raw-ip-result.json
- round234_raw_ip_drop.py