AF_VSOCK must not provide host communication through the ia32 socketcall
compatibility path. Accept EPERM or EACCES when socket creation is
denied.
If creation succeeds, connect to a CID-local host listener and exchange
distinct payloads in both directions.
Fail as soon as the host listener accepts the connection, and retain an
AF_INET socketcall success case to ensure that the restriction is
targeted.
The AF_VSOCK case is expected to fail on amd64 until policy or namespace
isolation closes the communication path.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Paweł Gronowski
181f24a4ab