diff options
| author | Ophestra <cat@gensokyo.uk> | 2025-07-01 20:23:33 +0900 |
|---|---|---|
| committer | Ophestra <cat@gensokyo.uk> | 2025-07-01 22:11:32 +0900 |
| commit | 1a8840bebc673672235b6e10b1b9386f24751757 (patch) | |
| tree | d1e6772bfd685e2162d047e3640bd3ee55c1a1f7 /hst | |
| parent | 1fb453dffe4c83866fedfa4590be30ec65e815ff (diff) | |
sandbox/seccomp: resolve rules natively
This enables loading syscall filter policies from external cross-platform config files.
This also removes a significant amount of C code.
Signed-off-by: Ophestra <cat@gensokyo.uk>
Diffstat (limited to 'hst')
| -rw-r--r-- | hst/container.go | 4 | ||||
| -rw-r--r-- | hst/template.go | 19 | ||||
| -rw-r--r-- | hst/template_test.go | 3 |
3 files changed, 15 insertions, 11 deletions
diff --git a/hst/container.go b/hst/container.go index 796b82e8..32ddef2e 100644 --- a/hst/container.go +++ b/hst/container.go @@ -11,7 +11,9 @@ type ( Hostname string `json:"hostname,omitempty"` // extra seccomp flags - Seccomp seccomp.FilterOpts `json:"seccomp"` + SeccompFlags seccomp.PrepareFlag `json:"seccomp_flags"` + // extra seccomp presets + SeccompPresets seccomp.FilterPreset `json:"seccomp_presets"` // allow ptrace and friends Devel bool `json:"devel,omitempty"` // allow userns creation in container diff --git a/hst/template.go b/hst/template.go index 4d054a49..bcf14ac4 100644 --- a/hst/template.go +++ b/hst/template.go @@ -57,15 +57,16 @@ func Template() *Config { Groups: []string{"video", "dialout", "plugdev"}, Container: &ContainerConfig{ - Hostname: "localhost", - Devel: true, - Userns: true, - Net: true, - Device: true, - Seccomp: seccomp.FilterMultiarch, - Tty: true, - Multiarch: true, - MapRealUID: true, + Hostname: "localhost", + Devel: true, + Userns: true, + Net: true, + Device: true, + SeccompFlags: seccomp.AllowMultiarch, + SeccompPresets: seccomp.PresetExt, + Tty: true, + Multiarch: true, + MapRealUID: true, // example API credentials pulled from Google Chrome // DO NOT USE THESE IN A REAL BROWSER Env: map[string]string{ diff --git a/hst/template_test.go b/hst/template_test.go index 74d258de..ad563317 100644 --- a/hst/template_test.go +++ b/hst/template_test.go @@ -80,7 +80,8 @@ func TestTemplate(t *testing.T) { ], "container": { "hostname": "localhost", - "seccomp": 32, + "seccomp_flags": 1, + "seccomp_presets": 1, "devel": true, "userns": true, "net": true, |