aboutsummaryrefslogtreecommitdiffhomepage
path: root/internal/sandbox
AgeCommit message (Collapse)Author
2025-03-17sandbox: move out of internalOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17sandbox: move params setup functionsOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17sandbox: wrap fmsg interfaceOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17seccomp: install output atomicallyOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-16sandbox: check command function pointerOphestra
Setting default CommandContext on initialisation is somewhat of a footgun. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-16ldd: lib paths resolve functionOphestra
This is what always happens right after a ldd call, so implement it here. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-16sandbox: return on zero length opsOphestra
This dodges potentially confusing behaviour where init fails due to Ops being clobbered during transfer. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-15sandbox/init: early params nil checkOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-15sandbox: return error on doubled startOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-15sandbox: expose cancel behaviourOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-14seccomp: move out of helperOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-14ldd: run in native sandboxOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-14sandbox: write uid/gid map as initOphestra
This avoids PR_SET_DUMPABLE in the parent process. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-14sandbox: invert seccomp ruleset defaultsOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-14sandbox: mount container /devOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-14sandbox/mount: pass custom tmpfs nameOphestra
The tmpfs driver allows arbitrary fsname. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-14sandbox: pass params to setup opsOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-14sandbox/mount: fix source flag pathOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-14sandbox: separate tmpfs function from opOphestra
This is useful in the implementation of various other ops. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-14sandbox: separate bind mount function from opOphestra
This is useful in the implementation of various other ops. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-13sandbox: native container toolingOphestra
This should eventually replace bwrap. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-13sandbox: read overflow idsOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
generated by cgit v1.3.1 (git 2.54.0) at 2026-08-30 22:15:43 +0000