Module capability

Expand description

Cheap TUN / CAP_NET_ADMIN capability probes.

Single source of truth for the two syscall-level probes both the zlayer daemon (zlayer-agent) and the unprivileged edge client use to decide whether overlay networking is viable:

probe_tun_device_available — can /dev/net/tun be opened r/w?
probe_has_cap_net_admin — is CAP_NET_ADMIN in the effective set?

Both are intentionally cheap and non-destructive — a single open(2) whose fd is dropped immediately, or one read of /proc/self/status. Neither allocates any kernel resource (no TUN interface is created, no capability is changed), so they are safe to call repeatedly. Non-Linux targets report a fixed false, since the kernel features these probes target are Linux-only.

Functions§

probe_has_cap_net_admin: true if CAP_NET_ADMIN is present in the process’s effective set (the CapEff: line of /proc/self/status). Linux only; always false on other targets.
probe_tun_device_available: true if /dev/net/tun can be opened r/w in non-blocking mode without error. The fd is dropped immediately (no TUN interface is allocated). Linux only; always false on other targets.