- NET_RAW
              # CAP_SYS_ADMIN is required for both ambient and repair, in order to open
              # network namespaces in `/proc` to obtain descriptors for entering pod netnamespaces.
              # There does not appear to be a more granular capability for this.
              - SYS_ADMIN
{{- if .Values.cni.seccompProfile }}
            seccompProfile:

			serviceCidr: "10.96.0.0/16,fda9:d324:354d:1::/112",
			expStr:      []string{"FileContent--proc-sys-net-ipv4-ip_forward", "FileContent--proc-sys-net-ipv6-conf-default-forwarding"},
		},
		{
			testName:    "single stack ipv4",
			PodSubnet:   "10.244.0.0/16",
			serviceCidr: "10.96.0.0/16",
			expStr:      []string{"FileContent--proc-sys-net-ipv4-ip_forward"},
		},
		{
			testName:    "single stack ipv6",

				// Number of probes.
				// ~ cat /proc/sys/net/ipv4/tcp_keepalive_probes (defaults to 9, we reduce it to 5)
				_ = syscall.SetsockoptInt(fd, syscall.IPPROTO_TCP, syscall.TCP_KEEPCNT, 5)

				// Wait time after successful probe in seconds.
				// ~ cat /proc/sys/net/ipv4/tcp_keepalive_intvl (defaults to 75 secs, we reduce it to 15 secs)

// word aligned. 5g should use MOVB to load the address
// of s.g[0] for its nil check.
//
// This test _may_ fail on arm, but requires the host to 
// trap unaligned loads. This is generally done with
//
// echo "4" > /proc/cpu/alignment

package main

var s = struct {
	// based on lzw.decoder
	a, b, c, d, e uint16
	f             [4096]uint8
	g             [4096]uint8
}{}

func main() {
	s.g[0] = 1

See the License for the specific language governing permissions and
limitations under the License.
*/

// Package procfs implements utility functions relating to the /proc mount.

	)
	pidfd = -1

	rlim := origRlimitNofile.Load()

	if sys.UidMappings != nil {
		puid = []byte("/proc/self/uid_map\000")
		uidmap = formatIDMappings(sys.UidMappings)
	}

	if sys.GidMappings != nil {
		psetgroups = []byte("/proc/self/setgroups\000")
		pgid = []byte("/proc/self/gid_map\000")

		if sys.GidMappingsEnableSetgroups {
			setgroups = []byte("allow\000")
		} else {

}

// interfaceMulticastAddrTable returns addresses for a specific
// interface.
func interfaceMulticastAddrTable(ifi *Interface) ([]Addr, error) {
	ifmat4 := parseProcNetIGMP("/proc/net/igmp", ifi)
	ifmat6 := parseProcNetIGMP6("/proc/net/igmp6", ifi)
	return append(ifmat4, ifmat6...), nil
}

func parseProcNetIGMP(path string, ifi *Interface) []Addr {
	fd, err := open(path)
	if err != nil {
		return nil
	}

// distinct mapped regions per process. As of this writing:
//
//	Darwin    unlimited
//	DragonFly   1000000 (vm.max_proc_mmap)
//	FreeBSD   unlimited
//	Linux         65530 (vm.max_map_count) // TODO: query /proc/sys/vm/max_map_count?
//	NetBSD    unlimited
//	OpenBSD   unlimited
var mmapLimit int32 = 1<<31 - 1

func init() {
	// Linux is the only practically concerning OS.
	if runtime.GOOS == "linux" {
		mmapLimit = 30000

// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

// Tests increasing and decreasing GOMAXPROCS to try and
// catch issues with stale proc state.

//go:build ignore

package main

import (
	"log"
	"os"
	"runtime"
	"runtime/trace"
	"time"
)

func main() {
	// Start a goroutine that calls runtime.GC to try and

	var ps []string
	switch runtime.GOOS {
	case "darwin", "ios", "dragonfly", "freebsd", "netbsd", "openbsd":
		ps = []string{
			"/dev/null",
		}
	case "linux":
		ps = []string{
			"/dev/null",
			"/proc/stat",
			"/sys/devices/system/cpu/online",
		}
	}
	nps := ps[:0]
	for _, p := range ps {
		f, err := os.Open(p)
		if err != nil {
			continue
		}
		f.Close()
		nps = append(nps, p)
	}