diff options
| author | Ophestra <cat@gensokyo.uk> | 2025-07-01 20:23:33 +0900 |
|---|---|---|
| committer | Ophestra <cat@gensokyo.uk> | 2025-07-01 22:11:32 +0900 |
| commit | 1a8840bebc673672235b6e10b1b9386f24751757 (patch) | |
| tree | d1e6772bfd685e2162d047e3640bd3ee55c1a1f7 /dbus | |
| parent | 1fb453dffe4c83866fedfa4590be30ec65e815ff (diff) | |
sandbox/seccomp: resolve rules natively
This enables loading syscall filter policies from external cross-platform config files.
This also removes a significant amount of C code.
Signed-off-by: Ophestra <cat@gensokyo.uk>
Diffstat (limited to 'dbus')
| -rw-r--r-- | dbus/dbus_test.go | 2 | ||||
| -rw-r--r-- | dbus/proc.go | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/dbus/dbus_test.go b/dbus/dbus_test.go index 7f57ceaa..36e9d65b 100644 --- a/dbus/dbus_test.go +++ b/dbus/dbus_test.go @@ -178,7 +178,7 @@ func testProxyFinaliseStartWaitCloseString(t *testing.T, useSandbox bool) { t.Run("string", func(t *testing.T) { wantSubstr := fmt.Sprintf("%s -test.run=TestHelperStub -- --args=3 --fd=4", os.Args[0]) if useSandbox { - wantSubstr = fmt.Sprintf(`argv: ["%s" "-test.run=TestHelperStub" "--" "--args=3" "--fd=4"], flags: 0x0, seccomp: 0x3e`, os.Args[0]) + wantSubstr = fmt.Sprintf(`argv: ["%s" "-test.run=TestHelperStub" "--" "--args=3" "--fd=4"], flags: 0x0, seccomp: 0x1, presets: 0xf`, os.Args[0]) } if got := p.String(); !strings.Contains(got, wantSubstr) { t.Errorf("String: %q, want %q", diff --git a/dbus/proc.go b/dbus/proc.go index 1b1a51c5..1a519617 100644 --- a/dbus/proc.go +++ b/dbus/proc.go @@ -66,7 +66,7 @@ func (p *Proxy) Start() error { ctx, toolPath, p.final, true, argF, func(container *sandbox.Container) { - container.Seccomp |= seccomp.FilterMultiarch + container.SeccompFlags |= seccomp.AllowMultiarch container.Hostname = "hakurei-dbus" container.CommandContext = p.CommandContext if p.output != nil { |