diff options
| author | Clayton Gilmer <netadr_t@outlook.com> | 2025-08-18 12:00:52 +0900 |
|---|---|---|
| committer | Ophestra <cat@gensokyo.uk> | 2025-08-18 16:28:14 +0900 |
| commit | 5db07140726e6e1bf615ed075e9a8b653508c2a7 (patch) | |
| tree | 15cdb5ed164ec5cdc32527f87ee969ad704cdd11 /internal/app | |
| parent | 69a4ab81053ef31d745ac0d92531cefb7d3a3e44 (diff) | |
container: optionally isolate host abstract UNIX domain sockets via landlock
Diffstat (limited to 'internal/app')
| -rw-r--r-- | internal/app/app_pd_linux_test.go | 2 | ||||
| -rw-r--r-- | internal/app/container_linux.go | 1 | ||||
| -rw-r--r-- | internal/app/seal_linux.go | 9 |
3 files changed, 8 insertions, 4 deletions
diff --git a/internal/app/app_pd_linux_test.go b/internal/app/app_pd_linux_test.go index 109e8816..96182d31 100644 --- a/internal/app/app_pd_linux_test.go +++ b/internal/app/app_pd_linux_test.go @@ -62,6 +62,7 @@ var testCasesPd = []sealTestCase{ Remount(m("/"), syscall.MS_RDONLY), SeccompPresets: seccomp.PresetExt | seccomp.PresetDenyDevel, HostNet: true, + HostAbstract: true, RetainSession: true, ForwardCancel: true, }, @@ -203,6 +204,7 @@ var testCasesPd = []sealTestCase{ Remount(m("/"), syscall.MS_RDONLY), SeccompPresets: seccomp.PresetExt | seccomp.PresetDenyDevel, HostNet: true, + HostAbstract: true, RetainSession: true, ForwardCancel: true, }, diff --git a/internal/app/container_linux.go b/internal/app/container_linux.go index 3f1259fd..7f088192 100644 --- a/internal/app/container_linux.go +++ b/internal/app/container_linux.go @@ -33,6 +33,7 @@ func newContainer(s *hst.ContainerConfig, os sys.State, prefix string, uid, gid SeccompPresets: s.SeccompPresets, RetainSession: s.Tty, HostNet: s.Net, + HostAbstract: s.Abstract, // the container is canceled when shim is requested to exit or receives an interrupt or termination signal; // this behaviour is implemented in the shim diff --git a/internal/app/seal_linux.go b/internal/app/seal_linux.go index c7293720..0ae121fb 100644 --- a/internal/app/seal_linux.go +++ b/internal/app/seal_linux.go @@ -238,10 +238,11 @@ func (seal *outcome) finalise(ctx context.Context, sys sys.State, config *hst.Co } conf := &hst.ContainerConfig{ - Userns: true, - Net: true, - Tty: true, - AutoEtc: true, + Userns: true, + Net: true, + Abstract: true, + Tty: true, + AutoEtc: true, AutoRoot: container.AbsFHSRoot, RootFlags: container.BindWritable, |