The time namespace's stated limit names every source of the machine's clock a zone reads

[DevomB]

What was wrong

The threat model's "Still shown" list and the net zone surface note gave two ways for a zone to get past its own clocks: the offsets in /proc/self/timens_offsets, and the scheduler's clock in /proc/<pid>/sched. Two more sources were not named, and neither can be withheld from a zone:

• The vDSO's time data. In Linux 6.18 a task in a time namespace gets the page with its offsets mapped in its vDSO data area, and the machine's own time data mapped in the next page, both readable. The vDSO reads both to answer clock_gettime (lib/vdso/datastore.c, vvar_fault).
• The CPU's timestamp counter. Any program reads it with rdtsc in user space, and it counts on from the CPU's reset whatever namespace reads it.

What changed

Docs only:

• docs/threat-model.md: the "Still shown" list names all four sources as giving the machine's uptime to code that looks past the zone's own clocks.
• docs/design/net-zone-surface.md: the time namespace section and the "leaves" row of the side-by-side table name all four sources.

The time namespace still keeps the shared uptime and boot time out of what crash reports and telemetry send. What it does not do is unchanged: it does not stop a zone that is trying to link itself to another.

How the run proves it

Docs only, so CI. The kernel references are checked against v6.18:

• lib/vdso/datastore.c maps the real time data at the time-namespace page offset when the task has a time-namespace page.
• fs/proc/base.c:3330 registers sched with no debug guard.