diff options
| author | Ophestra <cat@gensokyo.uk> | 2025-04-07 04:13:08 +0900 |
|---|---|---|
| committer | Ophestra <cat@gensokyo.uk> | 2025-04-07 04:13:08 +0900 |
| commit | 74ba18325684ad7172b5d7f04c3a9f46ea6ab9a0 (patch) | |
| tree | a4a6628626a6cfafc96562bd3c0aafe43e4f32ae | |
| parent | f885dede9b10c06004be0eac19d80b7bc718100a (diff) | |
app: install seccomp filter to shim
This does not necessarily reduce attack surface but does not affect functionality or introduce any side effects, so is nice to have.
Signed-off-by: Ophestra <cat@gensokyo.uk>
| -rw-r--r-- | internal/app/shim.go | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/internal/app/shim.go b/internal/app/shim.go index 4ebb2c32..ebc00aae 100644 --- a/internal/app/shim.go +++ b/internal/app/shim.go @@ -13,6 +13,7 @@ import ( "git.gensokyo.uk/security/fortify/internal" "git.gensokyo.uk/security/fortify/internal/fmsg" "git.gensokyo.uk/security/fortify/sandbox" + "git.gensokyo.uk/security/fortify/sandbox/seccomp" ) /* @@ -161,6 +162,13 @@ func ShimMain() { if err := container.Serve(); err != nil { fmsg.PrintBaseError(err, "cannot configure container:") } + + if err := seccomp.Load(seccomp.FlagExt | + seccomp.FlagDenyNS | seccomp.FlagDenyTTY | seccomp.FlagDenyDevel | + seccomp.FlagMultiarch); err != nil { + log.Fatalf("cannot load syscall filter: %v", err) + } + if err := container.Wait(); err != nil { var exitError *exec.ExitError if !errors.As(err, &exitError) { |