diff options
| author | Ophestra <cat@gensokyo.uk> | 2025-03-26 06:28:32 +0900 |
|---|---|---|
| committer | Ophestra <cat@gensokyo.uk> | 2025-03-26 06:32:08 +0900 |
| commit | 52fcc48ac141147324c3baac0e87ea49e8c2ca09 (patch) | |
| tree | a3b2cc75d7d7266427580258cfdd11dc307cb92f /sandbox/syscall.go | |
| parent | 8b69bcd2154fdc7903aceca662e9694588c982f2 (diff) | |
sandbox/init: drop capabilities
During development the syscall filter caused me to make an incorrect assumption about SysProcAttr.
Signed-off-by: Ophestra <cat@gensokyo.uk>
Diffstat (limited to 'sandbox/syscall.go')
| -rw-r--r-- | sandbox/syscall.go | 12 |
1 files changed, 9 insertions, 3 deletions
diff --git a/sandbox/syscall.go b/sandbox/syscall.go index d477dbc0..a92fa173 100644 --- a/sandbox/syscall.go +++ b/sandbox/syscall.go @@ -3,9 +3,15 @@ package sandbox import "syscall" const ( - O_PATH = 0x200000 + O_PATH = 0x200000 + PR_SET_NO_NEW_PRIVS = 0x26 - CAP_SYS_ADMIN = 0x15 + + PR_CAP_AMBIENT = 47 + PR_CAP_AMBIENT_CLEAR_ALL = 4 + + CAP_SYS_ADMIN = 0x15 + CAP_SETPCAP = 8 ) const ( @@ -15,7 +21,7 @@ const ( func SetDumpable(dumpable uintptr) error { // linux/sched/coredump.h - if _, _, errno := syscall.RawSyscall(syscall.SYS_PRCTL, syscall.PR_SET_DUMPABLE, dumpable, 0); errno != 0 { + if _, _, errno := syscall.Syscall(syscall.SYS_PRCTL, syscall.PR_SET_DUMPABLE, dumpable, 0); errno != 0 { return errno } |