diff options
| author | Ophestra <cat@gensokyo.uk> | 2025-08-20 00:27:45 +0900 |
|---|---|---|
| committer | Ophestra <cat@gensokyo.uk> | 2025-08-20 00:43:55 +0900 |
| commit | 13c7083bc028616e258e5e6919db7b11c6e739a6 (patch) | |
| tree | 0a2e0d1cc85a8211bd1ddb72c628ab9eb0556abe /container/init.go | |
| parent | 6947ff04e067bc7df1d9cf0ad993e3cab3568bf4 (diff) | |
container: ptrace protection via Yama LSM
This is only a nice to have feature as the init process has no additional privileges and the monitor process was never reachable anyway.
Closes #4.
Signed-off-by: Ophestra <cat@gensokyo.uk>
Diffstat (limited to 'container/init.go')
| -rw-r--r-- | container/init.go | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/container/init.go b/container/init.go index 885b543d..0f888fad 100644 --- a/container/init.go +++ b/container/init.go @@ -55,6 +55,11 @@ func Init(prepare func(prefix string), setVerbose func(verbose bool)) { log.Fatal("this process must run as pid 1") } + if err := SetPtracer(0); err != nil { + msg.Verbosef("cannot enable ptrace protection via Yama LSM: %v", err) + // not fatal: this program has no additional privileges at initial program start + } + var ( params initParams closeSetup func() error |