diff options
| author | Ophestra <cat@gensokyo.uk> | 2025-07-02 04:38:28 +0900 |
|---|---|---|
| committer | Ophestra <cat@gensokyo.uk> | 2025-07-02 04:47:13 +0900 |
| commit | 31aef905fa819310ee7694775a836c294ff742e4 (patch) | |
| tree | 168eb9f598d2cbb46695d2c3e9864cb9ba8d76c6 /internal/app/instance/common/container.go | |
| parent | a6887f7253ae822357f0d4d019675acc8c3e0b4d (diff) | |
sandbox: expose seccomp interface
There's no point in artificially limiting and abstracting away these options. The higher level hakurei package is responsible for providing a secure baseline and sane defaults. The sandbox package should present everything to the caller.
Signed-off-by: Ophestra <cat@gensokyo.uk>
Diffstat (limited to 'internal/app/instance/common/container.go')
| -rw-r--r-- | internal/app/instance/common/container.go | 18 |
1 files changed, 10 insertions, 8 deletions
diff --git a/internal/app/instance/common/container.go b/internal/app/instance/common/container.go index 6a32e9a8..d6342382 100644 --- a/internal/app/instance/common/container.go +++ b/internal/app/instance/common/container.go @@ -30,6 +30,8 @@ func NewContainer(s *hst.ContainerConfig, os sys.State, uid, gid *int) (*sandbox Hostname: s.Hostname, SeccompFlags: s.SeccompFlags, SeccompPresets: s.SeccompPresets, + RetainSession: s.Tty, + HostNet: s.Net, } { @@ -41,17 +43,17 @@ func NewContainer(s *hst.ContainerConfig, os sys.State, uid, gid *int) (*sandbox container.SeccompFlags |= seccomp.AllowMultiarch } - if s.Devel { - container.Flags |= sandbox.FAllowDevel + if !s.SeccompCompat { + container.SeccompPresets |= seccomp.PresetExt } - if s.Userns { - container.Flags |= sandbox.FAllowUserns + if !s.Devel { + container.SeccompPresets |= seccomp.PresetDenyDevel } - if s.Net { - container.Flags |= sandbox.FAllowNet + if !s.Userns { + container.SeccompPresets |= seccomp.PresetDenyNS } - if s.Tty { - container.Flags |= sandbox.FAllowTTY + if !s.Tty { + container.SeccompPresets |= seccomp.PresetDenyTTY } if s.MapRealUID { |