diff options
| author | Ophestra <cat@gensokyo.uk> | 2025-10-05 20:34:17 +0900 |
|---|---|---|
| committer | Ophestra <cat@gensokyo.uk> | 2025-10-05 20:47:30 +0900 |
| commit | f280994957bdc1c6defdd4bd9dcc44dd83a5cfd5 (patch) | |
| tree | b8026d970fdf18a61a74bdb3442ea5243814ef60 /test/sandbox | |
| parent | ae7b343cde93bf59d2e3c7f6316d41c1474dd081 (diff) | |
internal/app: check nscd socket for path hiding
This can seriously break things, and exposes extra host attack surface, so include it here.
Signed-off-by: Ophestra <cat@gensokyo.uk>
Diffstat (limited to 'test/sandbox')
| -rw-r--r-- | test/sandbox/case/pd.nix | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/test/sandbox/case/pd.nix b/test/sandbox/case/pd.nix index f98254f1..ad97c996 100644 --- a/test/sandbox/case/pd.nix +++ b/test/sandbox/case/pd.nix @@ -185,6 +185,7 @@ (ent "/" "/run/nscd" "ro,nosuid,nodev,relatime" "tmpfs" "readonly" "ro,mode=755,uid=1000000,gid=1000000") (ent "/etc" ignore "ro,nosuid,nodev,relatime" "ext4" "/dev/disk/by-label/nixos" "rw") (ent "/" "/run/user/1000" "rw,nosuid,nodev,relatime" "tmpfs" "ephemeral" "rw,size=8k,mode=755,uid=1000000,gid=1000000") + (ent "/" "/run/nscd" "rw,nosuid,nodev,relatime" "tmpfs" "ephemeral" "rw,size=8k,mode=755,uid=1000000,gid=1000000") (ent "/" "/run/dbus" "rw,nosuid,nodev,relatime" "tmpfs" "ephemeral" "rw,size=8k,mode=755,uid=1000000,gid=1000000") (ent "/" "/run/user" "rw,nosuid,nodev,relatime" "tmpfs" "ephemeral" "rw,size=4k,mode=755,uid=1000000,gid=1000000") (ent "/tmp/hakurei.0/runtime/0" "/run/user/65534" "rw,nosuid,nodev,relatime" "ext4" "/dev/disk/by-label/nixos" "rw") |