diff options
Diffstat (limited to 'internal/sandbox/container.go')
| -rw-r--r-- | internal/sandbox/container.go | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/internal/sandbox/container.go b/internal/sandbox/container.go index 4f8be1df..de71f372 100644 --- a/internal/sandbox/container.go +++ b/internal/sandbox/container.go @@ -20,12 +20,20 @@ import ( type HardeningFlags uintptr const ( - FAllowUserns HardeningFlags = 1 << iota + FSyscallCompat HardeningFlags = 1 << iota + FAllowDevel + FAllowUserns FAllowTTY FAllowNet ) func (flags HardeningFlags) seccomp(opts seccomp.SyscallOpts) seccomp.SyscallOpts { + if flags&FSyscallCompat == 0 { + opts |= seccomp.FlagExt + } + if flags&FAllowDevel == 0 { + opts |= seccomp.FlagDenyDevel + } if flags&FAllowUserns == 0 { opts |= seccomp.FlagDenyNS } |