diff options
| author | Ophestra <cat@gensokyo.uk> | 2025-02-15 03:12:28 +0900 |
|---|---|---|
| committer | Ophestra <cat@gensokyo.uk> | 2025-02-15 03:13:15 +0900 |
| commit | 72b0160aadac590bc479b9ec86e0378a95d2bdc0 (patch) | |
| tree | 6dc823776b40ef448e1ea6c073493cb426a84796 /helper/bwrap/config.go | |
| parent | ea8d1c07df18ceb94932fcc94ad00eb57c99da33 (diff) | |
helper/bwrap: implement file copy flags
These are significantly more efficient and less error-prone than mounting an external tmpfile. This should also reduce attack surface as the resulting files are private to its specific sandbox.
Signed-off-by: Ophestra <cat@gensokyo.uk>
Diffstat (limited to 'helper/bwrap/config.go')
| -rw-r--r-- | helper/bwrap/config.go | 3 |
1 files changed, 0 insertions, 3 deletions
diff --git a/helper/bwrap/config.go b/helper/bwrap/config.go index b9fa0c12..fdda14a4 100644 --- a/helper/bwrap/config.go +++ b/helper/bwrap/config.go @@ -71,9 +71,6 @@ type Config struct { --ro-bind-fd FD DEST Bind open directory or path fd read-only on DEST --exec-label LABEL Exec label for the sandbox --file-label LABEL File label for temporary sandbox content - --file FD DEST Copy from FD to destination DEST - --bind-data FD DEST Copy from FD to file which is bind-mounted on DEST - --ro-bind-data FD DEST Copy from FD to file which is readonly bind-mounted on DEST --add-seccomp-fd FD Load and use seccomp rules from FD (repeatable) --block-fd FD Block on FD until some data to read is available --userns-block-fd FD Block on FD until the user namespace is ready |