diff options
| author | Ophestra <cat@gensokyo.uk> | 2025-01-22 12:01:30 +0900 |
|---|---|---|
| committer | Ophestra <cat@gensokyo.uk> | 2025-01-22 12:01:30 +0900 |
| commit | 580128922be2a983192804b7963175b2a0fe2093 (patch) | |
| tree | fd74bda38a2f9c89ee7f0ae458f75c3fd88c2602 /cmd/fpkg/with.go | |
| parent | 23e1152baa345d36003c34086f9599df00ccd1a7 (diff) | |
cmd/fpkg: expose syscall policy options
Signed-off-by: Ophestra <cat@gensokyo.uk>
Diffstat (limited to 'cmd/fpkg/with.go')
| -rw-r--r-- | cmd/fpkg/with.go | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/cmd/fpkg/with.go b/cmd/fpkg/with.go index 53313671..03718dd0 100644 --- a/cmd/fpkg/with.go +++ b/cmd/fpkg/with.go @@ -5,6 +5,7 @@ import ( "strings" "git.gensokyo.uk/security/fortify/fst" + "git.gensokyo.uk/security/fortify/helper/bwrap" "git.gensokyo.uk/security/fortify/internal/fmsg" ) @@ -34,6 +35,7 @@ func withNixDaemon( Hostname: formatHostname(app.Name) + "-" + action, UserNS: true, // nix sandbox requires userns Net: net, + Syscall: &bwrap.SyscallPolicy{Multiarch: true}, NoNewSession: dropShell, Filesystem: []*fst.FilesystemConfig{ {Src: pathSet.nixPath, Dst: "/nix", Write: true, Must: true}, @@ -65,6 +67,7 @@ func withCacheDir(action string, command []string, workDir string, app *bundleIn Outer: pathSet.cacheDir, // this also ensures cacheDir via shim Sandbox: &fst.SandboxConfig{ Hostname: formatHostname(app.Name) + "-" + action, + Syscall: &bwrap.SyscallPolicy{Multiarch: true}, NoNewSession: dropShell, Filesystem: []*fst.FilesystemConfig{ {Src: path.Join(workDir, "nix"), Dst: "/nix", Must: true}, |