diff options
| author | Ophestra <cat@gensokyo.uk> | 2025-01-25 12:35:47 +0900 |
|---|---|---|
| committer | Ophestra <cat@gensokyo.uk> | 2025-01-25 12:35:47 +0900 |
| commit | 37780456a75c08652bd191d0e9c2bb9077198dc4 (patch) | |
| tree | 1b2fb59a4ed572ca6fea1ea6dee1894d62e44800 /helper/bwrap/seccomp.go | |
| parent | efacaa40fae42238e869524a5c2dca5ec7d94b3d (diff) | |
helper: block more unusual/privileged syscalls
These are toggled by F_EXT and exposed as SyscallPolicy.Compat in the Go interface.
Signed-off-by: Ophestra <cat@gensokyo.uk>
Diffstat (limited to 'helper/bwrap/seccomp.go')
| -rw-r--r-- | helper/bwrap/seccomp.go | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/helper/bwrap/seccomp.go b/helper/bwrap/seccomp.go index abc2738b..f77abc66 100644 --- a/helper/bwrap/seccomp.go +++ b/helper/bwrap/seccomp.go @@ -30,6 +30,7 @@ type ( ) const ( + flagExt syscallOpts = C.F_EXT flagDenyNS syscallOpts = C.F_DENY_NS flagDenyTTY syscallOpts = C.F_DENY_TTY flagDenyDevel syscallOpts = C.F_DENY_DEVEL |