v0.3.0 - Block AF_RXRPC (Dirty Frag mitigation)

Adds host-wide, no-reboot mitigation for the RxRPC variant of Dirty Frag on top of the existing CVE-2026-31431 ("Copy Fail") coverage.

The BPF-LSM socket_create hook now denies both AF_ALG and AF_RXRPC, but only when called from userspace — kernel-internal users (e.g. AFS, in-kernel crypto) keep working.

Install

kubectl apply -f https://raw.githubusercontent.com/cozystack/copy-fail-blocker/v0.3.0/manifests/copy-fail-blocker.yaml

Changes

• Block AF_RXRPC (33) socket creation to neutralize the RxRPC half of Dirty Frag (page-cache write via rxkad_verify_packet_1()).
• Limit denial to userspace callers via kern == 0 — kernel-internal callers (AFS, IPsec self-tests, etc.) are allowed.
• Helm chart and container image bumped to v0.3.0, image pinned by digest.
• README updated with Dirty Frag context, expanded mitigation table, updated verify snippet, expanded Limitations.

Scope

• Closes the RxRPC variant of Dirty Frag and the existing Copy Fail (AF_ALG) path.
• Does not close the xfrm-ESP variant of Dirty Frag — tracking separately.
• Clusters running OpenAFS / kAFS userspace clients should not deploy on those nodes.