diff options
| author | Ophestra <cat@gensokyo.uk> | 2025-03-14 02:38:32 +0900 |
|---|---|---|
| committer | Ophestra <cat@gensokyo.uk> | 2025-03-14 02:38:32 +0900 |
| commit | 94895bbacb42b82673b07142e786855a8ac756dc (patch) | |
| tree | 77c6aaad5eee06b3f103fc2f59dfb1c55913b4ca | |
| parent | f332200ca4a18ae098e4c42509ba1256d8562cf9 (diff) | |
sandbox: invert seccomp ruleset defaults
Signed-off-by: Ophestra <cat@gensokyo.uk>
| -rw-r--r-- | internal/sandbox/container.go | 10 | ||||
| -rw-r--r-- | internal/sandbox/container_test.go | 2 |
2 files changed, 9 insertions, 3 deletions
diff --git a/internal/sandbox/container.go b/internal/sandbox/container.go index 4f8be1df..de71f372 100644 --- a/internal/sandbox/container.go +++ b/internal/sandbox/container.go @@ -20,12 +20,20 @@ import ( type HardeningFlags uintptr const ( - FAllowUserns HardeningFlags = 1 << iota + FSyscallCompat HardeningFlags = 1 << iota + FAllowDevel + FAllowUserns FAllowTTY FAllowNet ) func (flags HardeningFlags) seccomp(opts seccomp.SyscallOpts) seccomp.SyscallOpts { + if flags&FSyscallCompat == 0 { + opts |= seccomp.FlagExt + } + if flags&FAllowDevel == 0 { + opts |= seccomp.FlagDenyDevel + } if flags&FAllowUserns == 0 { opts |= seccomp.FlagDenyNS } diff --git a/internal/sandbox/container_test.go b/internal/sandbox/container_test.go index 1579dbaa..9837e11c 100644 --- a/internal/sandbox/container_test.go +++ b/internal/sandbox/container_test.go @@ -13,7 +13,6 @@ import ( "time" "git.gensokyo.uk/security/fortify/fst" - "git.gensokyo.uk/security/fortify/helper/seccomp" "git.gensokyo.uk/security/fortify/internal" "git.gensokyo.uk/security/fortify/internal/fmsg" "git.gensokyo.uk/security/fortify/internal/sandbox" @@ -71,7 +70,6 @@ func TestContainer(t *testing.T) { return exec.CommandContext(ctx, os.Args[0], "-test.v", "-test.run=TestHelperInit", "--", "init") } - container.Seccomp |= seccomp.FlagExt container.Flags |= tc.flags container.Stdout, container.Stderr = os.Stdout, os.Stderr container.Ops = tc.ops |