diff options
Diffstat (limited to 'internal/app')
| -rw-r--r-- | internal/app/instance/common/container.go | 7 | ||||
| -rw-r--r-- | internal/app/internal/setuid/shim.go | 2 |
2 files changed, 5 insertions, 4 deletions
diff --git a/internal/app/instance/common/container.go b/internal/app/instance/common/container.go index 567a8aa7..6a32e9a8 100644 --- a/internal/app/instance/common/container.go +++ b/internal/app/instance/common/container.go @@ -27,8 +27,9 @@ func NewContainer(s *hst.ContainerConfig, os sys.State, uid, gid *int) (*sandbox } container := &sandbox.Params{ - Hostname: s.Hostname, - Seccomp: s.Seccomp, + Hostname: s.Hostname, + SeccompFlags: s.SeccompFlags, + SeccompPresets: s.SeccompPresets, } { @@ -37,7 +38,7 @@ func NewContainer(s *hst.ContainerConfig, os sys.State, uid, gid *int) (*sandbox } if s.Multiarch { - container.Seccomp |= seccomp.FilterMultiarch + container.SeccompFlags |= seccomp.AllowMultiarch } if s.Devel { diff --git a/internal/app/internal/setuid/shim.go b/internal/app/internal/setuid/shim.go index 15587cde..196fcfe9 100644 --- a/internal/app/internal/setuid/shim.go +++ b/internal/app/internal/setuid/shim.go @@ -163,7 +163,7 @@ func ShimMain() { hlog.PrintBaseError(err, "cannot configure container:") } - if err := seccomp.Load(seccomp.PresetCommon); err != nil { + if err := seccomp.Load(seccomp.PresetStrict, seccomp.AllowMultiarch); err != nil { log.Fatalf("cannot load syscall filter: %v", err) } |