[DevomB]

Merge after #305 and #306. Two of the checks it names, radio-recarried and uplink-state-reset, arrive with them; both are in linux-distro-7d's batch.

What was wrong. The threat model said of a compromised net zone only that it "gets no zone's files and not vault". It did not say what such a zone can still reach or deny, what limits it, or what is kept that way on purpose. Each of those is now settled in the tree and proven by a check.

What changed. A new section in docs/threat-model.md, "Compromised net zone", under "Network attacker". Each item is one sentence:

• It can still: MITM, deny or route between routed zones; reach nf_tables, packet sockets and every generic-netlink family (the Wi-Fi drivers' vendor commands and ethtool's netlink setters, a pluggable module's firmware among them); keep the machine or a zone offline; read the Wi-Fi passphrases it holds; withhold releases (reported after 30 days, counted from the install when none was accepted); and claim clock offsets (applied up to an hour, beyond that only with the user's consent). nl80211's testmode is named as not built: 6.18's Kconfig gives it no default, and neither defconfig nor the fragments set it.
• What limits it, each with its check:
  • dhcpcd-separated and dnsmasq-unprivileged: the parsers run without the zone's root;
  • fetch-and-sntp-no-caps: the update fetcher and the SNTP client hold no capability;
  • net-cpu-max-set and net-zone-sysfs-nics-only: the zone's CPU and what its /sys shows;
  • the unit test nic_writing_ioctls_are_refused: NIC-writing ioctls are refused;
  • uplink-renamed-plain, uplink-state-reset and radio-recarried: what it leaves on a NIC does not reach the next net zone.
  • Wake-on-LAN is named as turned off but not shown by any suite, since no test machine's NIC has it.
• What a routed zone cannot do through it:
  • zone-source-pinned: send as another zone;
  • bridge-ports-closed: reach what else listens in the net zone;
  • zone-flows-capped: fill the connection-tracking table;
  • dns-cache-off and dns-counters-hidden: learn another zone's lookups.
• Kept by design:
  • wire confidentiality is the application's;
  • wpa_supplicant runs as the zone's root;
  • nf_tables, packet sockets and generic netlink stay open, since NAT, DHCP and Wi-Fi need them;
  • a flooding routed zone can hold dnsmasq's 150 forwarding slots (10 s each) and the bandwidth;
  • EEE, offloads, rings, coalescing and WoWLAN are not set back.

How it is checked. Docs only, nothing in the image changes, so CI and a non-author read stand in for a Distro run. Every check named is in the zones suite on main once #305 and #306 merge, or, for the ioctls, in kryptikd's unit tests.