diff options
| -rw-r--r-- | internal/sandbox/container.go | 10 | ||||
| -rw-r--r-- | internal/sandbox/container_test.go | 2 |
2 files changed, 9 insertions, 3 deletions
diff --git a/internal/sandbox/container.go b/internal/sandbox/container.go index 4f8be1df..de71f372 100644 --- a/internal/sandbox/container.go +++ b/internal/sandbox/container.go @@ -20,12 +20,20 @@ import ( type HardeningFlags uintptr const ( - FAllowUserns HardeningFlags = 1 << iota + FSyscallCompat HardeningFlags = 1 << iota + FAllowDevel + FAllowUserns FAllowTTY FAllowNet ) func (flags HardeningFlags) seccomp(opts seccomp.SyscallOpts) seccomp.SyscallOpts { + if flags&FSyscallCompat == 0 { + opts |= seccomp.FlagExt + } + if flags&FAllowDevel == 0 { + opts |= seccomp.FlagDenyDevel + } if flags&FAllowUserns == 0 { opts |= seccomp.FlagDenyNS } diff --git a/internal/sandbox/container_test.go b/internal/sandbox/container_test.go index 1579dbaa..9837e11c 100644 --- a/internal/sandbox/container_test.go +++ b/internal/sandbox/container_test.go @@ -13,7 +13,6 @@ import ( "time" "git.gensokyo.uk/security/fortify/fst" - "git.gensokyo.uk/security/fortify/helper/seccomp" "git.gensokyo.uk/security/fortify/internal" "git.gensokyo.uk/security/fortify/internal/fmsg" "git.gensokyo.uk/security/fortify/internal/sandbox" @@ -71,7 +70,6 @@ func TestContainer(t *testing.T) { return exec.CommandContext(ctx, os.Args[0], "-test.v", "-test.run=TestHelperInit", "--", "init") } - container.Seccomp |= seccomp.FlagExt container.Flags |= tc.flags container.Stdout, container.Stderr = os.Stdout, os.Stderr container.Ops = tc.ops |