diff options
| author | Clayton Gilmer <netadr_t@outlook.com> | 2025-08-18 12:00:52 +0900 |
|---|---|---|
| committer | Ophestra <cat@gensokyo.uk> | 2025-08-18 16:28:14 +0900 |
| commit | 5db07140726e6e1bf615ed075e9a8b653508c2a7 (patch) | |
| tree | 15cdb5ed164ec5cdc32527f87ee969ad704cdd11 /internal/app/seal_linux.go | |
| parent | 69a4ab81053ef31d745ac0d92531cefb7d3a3e44 (diff) | |
container: optionally isolate host abstract UNIX domain sockets via landlock
Diffstat (limited to 'internal/app/seal_linux.go')
| -rw-r--r-- | internal/app/seal_linux.go | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/internal/app/seal_linux.go b/internal/app/seal_linux.go index c7293720..0ae121fb 100644 --- a/internal/app/seal_linux.go +++ b/internal/app/seal_linux.go @@ -238,10 +238,11 @@ func (seal *outcome) finalise(ctx context.Context, sys sys.State, config *hst.Co } conf := &hst.ContainerConfig{ - Userns: true, - Net: true, - Tty: true, - AutoEtc: true, + Userns: true, + Net: true, + Abstract: true, + Tty: true, + AutoEtc: true, AutoRoot: container.AbsFHSRoot, RootFlags: container.BindWritable, |