diff options
Diffstat (limited to 'internal')
| -rw-r--r-- | internal/app/app_nixos_linux_test.go | 2 | ||||
| -rw-r--r-- | internal/app/container_linux.go | 2 | ||||
| -rw-r--r-- | internal/app/seal_linux.go | 4 |
3 files changed, 1 insertions, 7 deletions
diff --git a/internal/app/app_nixos_linux_test.go b/internal/app/app_nixos_linux_test.go index 303d535d..c11fbd81 100644 --- a/internal/app/app_nixos_linux_test.go +++ b/internal/app/app_nixos_linux_test.go @@ -28,7 +28,6 @@ var testCasesNixos = []sealTestCase{ {Src: "/sys/block"}, {Src: "/sys/bus"}, {Src: "/sys/class"}, {Src: "/sys/dev"}, {Src: "/sys/devices"}, {Src: "/run/opengl-driver", Must: true}, {Src: "/dev/dri", Device: true}, }, - Cover: []string{"/var/run/nscd"}, }, SystemBus: &dbus.Config{ Talk: []string{"org.bluez", "org.freedesktop.Avahi", "org.freedesktop.UPower"}, @@ -143,7 +142,6 @@ var testCasesNixos = []sealTestCase{ Place(hst.Tmp+"/pulse-cookie", nil). Bind("/tmp/hakurei.1971/8e2c76b066dabe574cf073bdb46eb5c1/bus", "/run/user/1971/bus", 0). Bind("/tmp/hakurei.1971/8e2c76b066dabe574cf073bdb46eb5c1/system_bus_socket", "/run/dbus/system_bus_socket", 0). - Tmpfs("/var/run/nscd", 8192, 0755). Remount("/", syscall.MS_RDONLY), SeccompPresets: seccomp.PresetExt | seccomp.PresetDenyTTY | seccomp.PresetDenyDevel, HostNet: true, diff --git a/internal/app/container_linux.go b/internal/app/container_linux.go index 09909d83..ce3a5154 100644 --- a/internal/app/container_linux.go +++ b/internal/app/container_linux.go @@ -40,7 +40,7 @@ func newContainer(s *hst.ContainerConfig, os sys.State, prefix string, uid, gid } { - ops := make(container.Ops, 0, preallocateOpsCount+len(s.Filesystem)+len(s.Link)+len(s.Cover)) + ops := make(container.Ops, 0, preallocateOpsCount+len(s.Filesystem)+len(s.Link)) params.Ops = &ops } diff --git a/internal/app/seal_linux.go b/internal/app/seal_linux.go index b25b5c4f..6bf6c092 100644 --- a/internal/app/seal_linux.go +++ b/internal/app/seal_linux.go @@ -474,10 +474,6 @@ func (seal *outcome) finalise(ctx context.Context, sys sys.State, config *hst.Co } } - for _, dest := range config.Container.Cover { - seal.container.Tmpfs(dest, 1<<13, 0755) - } - // mount root read-only as the final setup Op seal.container.Remount("/", syscall.MS_RDONLY) |