From c351246ce880b1ee4568160db0fbf80abbd6f445 Mon Sep 17 00:00:00 2001
From: Kevin Krakauer <krakauer@google.com>
Date: Tue, 30 Jan 2024 10:16:36 -0800
Subject: [PATCH] netstack: log upon attempted raw socket creation when
 --net-raw is missing

Helpful when debugging issues like #9917.
---
 pkg/sentry/socket/netstack/provider.go | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkg/sentry/socket/netstack/provider.go b/pkg/sentry/socket/netstack/provider.go
index 46fa9dc69..3a18b2916 100644
--- a/pkg/sentry/socket/netstack/provider.go
+++ b/pkg/sentry/socket/netstack/provider.go
@@ -167,6 +167,9 @@ func packetSocket(t *kernel.Task, epStack *Stack, stype linux.SockType, protocol
 	wq := &waiter.Queue{}
 	ep, err := epStack.Stack.NewPacketEndpoint(cooked, netProto, wq)
 	if err != nil {
+		if _, ok := err.(*tcpip.ErrNotPermitted); ok {
+			rawMissingLogger.Infof("A process tried to create a raw socket, which is disabled by default. Should the runtime config enable --net-raw?")
+		}
 		return nil, syserr.TranslateNetstackError(err)
 	}