[enyonee]

--unshare-net fails with loopback: Failed RTM_NEWADDR when the new network namespace already has its loopback configured. This happens with bubblewrap 0.12.0 under gVisor release-20260914.0; the unconditional setup is still present on current main.

In a fresh gVisor network namespace, lo is already up with 127.0.0.1/8. Adding that same address with RTM_NEWADDR | NLM_F_CREATE | NLM_F_EXCL receives NLMSG_ERROR with -EEXIST. The printed errno can be misleading because rtnl_read_reply() currently does not propagate the netlink error to errno.

Check whether loopback already has the required state before configuring it. Return early only when the interface has both IFF_UP and IFF_LOOPBACK, the address and netmask queries succeed with AF_INET, and the values are exactly 127.0.0.1 and 255.0.0.0. Each query uses a separate zero-initialized request; gVisor can preserve the supplied address family while writing only the address. Query failures and state mismatches retain the original setup and fatal error handling.

The check runs after the existing network namespace creation, so --unshare-net keeps creating its private namespace. No namespace, capability, seccomp, or mount restrictions are removed.

Reproducer inside an existing gVisor container:

bwrap --ro-bind / / --unshare-net /bin/true

Validation:

• A Meson TAP regression test covers 13 cases: configured loopback, query errors, missing/wrong flags, address, family, or netmask, including descriptor cleanup and partial sockaddr writes.
• GCC 14.2 + Meson 1.7.0 build with ASan/UBSan passed. The full Meson test run passed both unit programs (13 network and 26 utility subtests); five namespace integration programs skipped because this ordinary Docker test container denies namespace creation.
• The network regression also passed a strict -Wall -Wextra -Werror build. Replacing the guard with an unconditional skip makes its second case fail, as expected.
• The same source fix backported to 0.12.0 passed four existing integration checks under runsc release-20260914.0 with UID/GID 1000, zero capabilities, and NoNewPrivs=1. Those checks cover command execution, file-descriptor environment handoff, raw network separation, read-only filesystem restrictions, and failure before the command when the sandbox binary is missing. A further six-check run verified private loopback and writable profile home with owner/sibling home restrictions.

Fixes #745
Related: google/gvisor#13438