diff options
| author | Ophestra <cat@gensokyo.uk> | 2025-10-05 20:34:17 +0900 |
|---|---|---|
| committer | Ophestra <cat@gensokyo.uk> | 2025-10-05 20:47:30 +0900 |
| commit | f280994957bdc1c6defdd4bd9dcc44dd83a5cfd5 (patch) | |
| tree | b8026d970fdf18a61a74bdb3442ea5243814ef60 /internal/app/app_test.go | |
| parent | ae7b343cde93bf59d2e3c7f6316d41c1474dd081 (diff) | |
internal/app: check nscd socket for path hiding
This can seriously break things, and exposes extra host attack surface, so include it here.
Signed-off-by: Ophestra <cat@gensokyo.uk>
Diffstat (limited to 'internal/app/app_test.go')
| -rw-r--r-- | internal/app/app_test.go | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/internal/app/app_test.go b/internal/app/app_test.go index 57d81ef2..0c545023 100644 --- a/internal/app/app_test.go +++ b/internal/app/app_test.go @@ -73,6 +73,7 @@ func TestApp(t *testing.T) { Readonly(m("/var/run/nscd"), 0755). Etc(m("/etc/"), "4a450b6596d7bc15bd01780eb9a607ac"). Tmpfs(m("/run/user/1971"), 8192, 0755). + Tmpfs(m("/run/nscd"), 8192, 0755). Tmpfs(m("/run/dbus"), 8192, 0755). Remount(m("/dev/"), syscall.MS_RDONLY). Tmpfs(m("/run/user/"), 4096, 0755). @@ -209,6 +210,7 @@ func TestApp(t *testing.T) { Readonly(m("/var/run/nscd"), 0755). Etc(m("/etc/"), "ebf083d1b175911782d413369b64ce7c"). Tmpfs(m("/run/user/1971"), 8192, 0755). + Tmpfs(m("/run/nscd"), 8192, 0755). Tmpfs(m("/run/dbus"), 8192, 0755). Remount(m("/dev/"), syscall.MS_RDONLY). Tmpfs(m("/run/user/"), 4096, 0755). @@ -552,6 +554,8 @@ func (k *stubNixOS) tempdir() string { return "/tmp/" } func (k *stubNixOS) evalSymlinks(path string) (string, error) { switch path { + case "/var/run/nscd": + return "/run/nscd", nil case "/run/user/1971": return "/run/user/1971", nil case "/tmp/hakurei.0": |