diff options
Diffstat (limited to 'dbus/run.go')
| -rw-r--r-- | dbus/run.go | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/dbus/run.go b/dbus/run.go index 0a554bfb..0dfe7f85 100644 --- a/dbus/run.go +++ b/dbus/run.go @@ -16,7 +16,7 @@ import ( // Start launches the D-Bus proxy and sets up the Wait method. // ready should be buffered and must only be received from once. -func (p *Proxy) Start(ready chan error, output io.Writer, sandbox bool) error { +func (p *Proxy) Start(ready chan error, output io.Writer, sandbox, seccomp bool) error { p.lock.Lock() defer p.lock.Unlock() @@ -67,11 +67,16 @@ func (p *Proxy) Start(ready chan error, output io.Writer, sandbox bool) error { Unshare: nil, Hostname: "fortify-dbus", Chdir: "/", + Syscall: &bwrap.SyscallPolicy{DenyDevel: true, Multiarch: true}, Clearenv: true, NewSession: true, DieWithParent: true, } + if !seccomp { + bc.Syscall = nil + } + // resolve proxy socket directories bindTarget := make(map[string]struct{}, 2) for _, ps := range []string{p.session[1], p.system[1]} { |