diff options
| author | Ophestra <cat@gensokyo.uk> | 2025-04-11 20:01:54 +0900 |
|---|---|---|
| committer | Ophestra <cat@gensokyo.uk> | 2025-04-11 20:01:54 +0900 |
| commit | ae6f5ede1928c9d0a2d480b6a924914e8599529f (patch) | |
| tree | e9f4c57f0c22fad5459b19157f416c50948e33bc | |
| parent | 807d511c8b87b9a173bd89ee49c73330fa8b93c7 (diff) | |
fst: mount passthrough /dev writable
Signed-off-by: Ophestra <cat@gensokyo.uk>
| -rw-r--r-- | fst/sandbox.go | 2 | ||||
| -rw-r--r-- | test/sandbox/case/device.nix | 6 |
2 files changed, 4 insertions, 4 deletions
diff --git a/fst/sandbox.go b/fst/sandbox.go index 0cc37908..194fcb76 100644 --- a/fst/sandbox.go +++ b/fst/sandbox.go @@ -138,7 +138,7 @@ func (s *SandboxConfig) ToContainer(sys SandboxSys, uid, gid *int) (*sandbox.Par if !s.Device { container.Dev("/dev").Mqueue("/dev/mqueue") } else { - container.Bind("/dev", "/dev", sandbox.BindDevice) + container.Bind("/dev", "/dev", sandbox.BindWritable|sandbox.BindDevice) } /* retrieve paths and hide them if they're made available in the sandbox; diff --git a/test/sandbox/case/device.nix b/test/sandbox/case/device.nix index 28b714f6..a49ac68c 100644 --- a/test/sandbox/case/device.nix +++ b/test/sandbox/case/device.nix @@ -171,9 +171,9 @@ (ent "/sysroot" "/" "rw,nosuid,nodev,relatime" "tmpfs" "rootfs" "rw,uid=1000004,gid=1000004") (ent "/" "/proc" "rw,nosuid,nodev,noexec,relatime" "proc" "proc" "rw") (ent "/" "/.fortify" "rw,nosuid,nodev,relatime" "tmpfs" "tmpfs" "rw,size=4k,mode=755,uid=1000004,gid=1000004") - (ent "/" "/dev" "ro,nosuid" "devtmpfs" "devtmpfs" ignore) - (ent "/" "/dev/pts" "ro,nosuid,noexec,relatime" "devpts" "devpts" "rw,gid=3,mode=620,ptmxmode=666") - (ent "/" "/dev/shm" "ro,nosuid,nodev" "tmpfs" "tmpfs" ignore) + (ent "/" "/dev" "rw,nosuid" "devtmpfs" "devtmpfs" ignore) + (ent "/" "/dev/pts" "rw,nosuid,noexec,relatime" "devpts" "devpts" "rw,gid=3,mode=620,ptmxmode=666") + (ent "/" "/dev/shm" "rw,nosuid,nodev" "tmpfs" "tmpfs" ignore) (ent "/" ignore ignore ignore ignore ignore) # order not deterministic (ent "/" ignore ignore ignore ignore ignore) (ent "/bin" "/bin" "ro,nosuid,nodev,relatime" "ext4" "/dev/disk/by-label/nixos" "rw") |