diff options
| author | Ophestra <cat@gensokyo.uk> | 2026-01-21 04:49:25 +0900 |
|---|---|---|
| committer | Ophestra <cat@gensokyo.uk> | 2026-01-21 04:49:25 +0900 |
| commit | ba75587132d379932362bf86a73811608f810f33 (patch) | |
| tree | 68b76e70ec8ce58b52031fd08132cffe629fbd87 /internal | |
| parent | 9a06ce2db06908b069f441a62d5283115919dbd9 (diff) | |
internal/pkg: allow user namespace creation
No good reason to filter this in the execArtifact container, and the extended filter breaks certain programs.
Signed-off-by: Ophestra <cat@gensokyo.uk>
Diffstat (limited to 'internal')
| -rw-r--r-- | internal/pkg/exec.go | 2 | ||||
| -rw-r--r-- | internal/rosa/python.go | 5 |
2 files changed, 3 insertions, 4 deletions
diff --git a/internal/pkg/exec.go b/internal/pkg/exec.go index a4ade28b..f8913174 100644 --- a/internal/pkg/exec.go +++ b/internal/pkg/exec.go @@ -290,7 +290,7 @@ func (a *execArtifact) cure(f *FContext, hostNet bool) (err error) { z := container.New(ctx, f.GetMessage()) z.WaitDelay = execWaitDelay - z.SeccompPresets |= std.PresetStrict + z.SeccompPresets |= std.PresetStrict & ^std.PresetDenyNS z.ParentPerm = 0700 z.HostNet = hostNet z.Hostname = "cure" diff --git a/internal/rosa/python.go b/internal/rosa/python.go index 274fe818..3e82427c 100644 --- a/internal/rosa/python.go +++ b/internal/rosa/python.go @@ -20,10 +20,9 @@ func (t Toolchain) NewPython() pkg.Artifact { "test_urllibnet", "test_urllib2net", - // hits std.PresetExt ruleset + // makes assumptions about uid_map/gid_map "test_os", - "test_posix", - "test_shutil", + "test_subprocess", // somehow picks up mtime of source code "test_zipfile", |