diff options
| author | Ophestra <cat@gensokyo.uk> | 2025-07-02 04:38:28 +0900 |
|---|---|---|
| committer | Ophestra <cat@gensokyo.uk> | 2025-07-02 04:47:13 +0900 |
| commit | 31aef905fa819310ee7694775a836c294ff742e4 (patch) | |
| tree | 168eb9f598d2cbb46695d2c3e9864cb9ba8d76c6 /dbus | |
| parent | a6887f7253ae822357f0d4d019675acc8c3e0b4d (diff) | |
sandbox: expose seccomp interface
There's no point in artificially limiting and abstracting away these options. The higher level hakurei package is responsible for providing a secure baseline and sane defaults. The sandbox package should present everything to the caller.
Signed-off-by: Ophestra <cat@gensokyo.uk>
Diffstat (limited to 'dbus')
| -rw-r--r-- | dbus/dbus_test.go | 2 | ||||
| -rw-r--r-- | dbus/proc.go | 1 |
2 files changed, 2 insertions, 1 deletions
diff --git a/dbus/dbus_test.go b/dbus/dbus_test.go index 36e9d65b..77a3e4f6 100644 --- a/dbus/dbus_test.go +++ b/dbus/dbus_test.go @@ -178,7 +178,7 @@ func testProxyFinaliseStartWaitCloseString(t *testing.T, useSandbox bool) { t.Run("string", func(t *testing.T) { wantSubstr := fmt.Sprintf("%s -test.run=TestHelperStub -- --args=3 --fd=4", os.Args[0]) if useSandbox { - wantSubstr = fmt.Sprintf(`argv: ["%s" "-test.run=TestHelperStub" "--" "--args=3" "--fd=4"], flags: 0x0, seccomp: 0x1, presets: 0xf`, os.Args[0]) + wantSubstr = fmt.Sprintf(`argv: ["%s" "-test.run=TestHelperStub" "--" "--args=3" "--fd=4"], filter: true, rules: 0, flags: 0x1, presets: 0xf`, os.Args[0]) } if got := p.String(); !strings.Contains(got, wantSubstr) { t.Errorf("String: %q, want %q", diff --git a/dbus/proc.go b/dbus/proc.go index 1a519617..283f31c5 100644 --- a/dbus/proc.go +++ b/dbus/proc.go @@ -67,6 +67,7 @@ func (p *Proxy) Start() error { p.final, true, argF, func(container *sandbox.Container) { container.SeccompFlags |= seccomp.AllowMultiarch + container.SeccompPresets |= seccomp.PresetStrict container.Hostname = "hakurei-dbus" container.CommandContext = p.CommandContext if p.output != nil { |