diff options
| author | Ophestra Umiker <cat@ophivana.moe> | 2024-10-13 00:07:48 +0900 |
|---|---|---|
| committer | Ophestra Umiker <cat@ophivana.moe> | 2024-10-13 00:07:48 +0900 |
| commit | c818ea649a416b35040bee85f1943e21065cfb51 (patch) | |
| tree | 0bf67d7c9c1e6812f8bd40f31e2adef48ccba869 | |
| parent | b091260fd3db6a1fff93bf4f6c75cf575b2424f3 (diff) | |
app/seal: skip /mnt in permissive default
This directory usually contains temporarily mounted stuff and shouldn't get into the sandbox.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
| -rw-r--r-- | internal/app/seal.go | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/internal/app/seal.go b/internal/app/seal.go index 4a211dba..fd42af6d 100644 --- a/internal/app/seal.go +++ b/internal/app/seal.go @@ -134,6 +134,7 @@ func (a *app) Seal(config *Config) error { case "proc": case "dev": case "run": + case "mnt": default: p := "/" + name b = append(b, &FilesystemConfig{Src: p, Write: true, Must: true}) |