sandbox: invert seccomp ruleset defaults

Signed-off-by: Ophestra <cat@gensokyo.uk>

1 files changed, 9 insertions, 1 deletions

diff --git a/internal/sandbox/container.go b/internal/sandbox/container.go
index 4f8be1df..de71f372 100644
--- a/internal/sandbox/container.go
+++ b/internal/sandbox/container.go
@@ -20,12 +20,20 @@ import (
 type HardeningFlags uintptr
 
 const (
-	FAllowUserns HardeningFlags = 1 << iota
+	FSyscallCompat HardeningFlags = 1 << iota
+	FAllowDevel
+	FAllowUserns
 	FAllowTTY
 	FAllowNet
 )
 
 func (flags HardeningFlags) seccomp(opts seccomp.SyscallOpts) seccomp.SyscallOpts {
+	if flags&FSyscallCompat == 0 {
+		opts |= seccomp.FlagExt
+	}
+	if flags&FAllowDevel == 0 {
+		opts |= seccomp.FlagDenyDevel
+	}
 	if flags&FAllowUserns == 0 {
 		opts |= seccomp.FlagDenyNS
 	}