aboutsummaryrefslogtreecommitdiffhomepage
path: root/ldd/exec.go
AgeCommit message (Collapse)Author
2025-06-25treewide: rename to hakureiOphestra
Fortify makes little sense for a container tool. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17sandbox: move out of internalOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17ldd: always copy stderrOphestra
Dropping the buffer on success is unhelpful and could hide some useful information. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17ldd: mount /proc in containerOphestra
This covers host /proc. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-16sandbox: check command function pointerOphestra
Setting default CommandContext on initialisation is somewhat of a footgun. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-14ldd: run in native sandboxOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-12ldd: handle musl static behaviourOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-25dbus: set process group idOphestra
This stops signals sent by the TTY driver from propagating to the xdg-dbus-proxy process. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-23ldd: handle behaviour on static executableOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-23ldd: pass absolute path to bwrapOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-13helper: use generic extra files interfaceOphestra
This replaces the pipes object and integrates context into helper process lifecycle. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-01-22ldd: enable syscall filterOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-01-22helper/bwrap: integrate seccomp into helper interfaceOphestra
This makes API usage much cleaner, and encapsulates all bwrap arguments in argsWt. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-01-19helper/bwrap: move sync to helper stateOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2024-12-20migrate to git.gensokyo.uk/security/fortifyOphestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-10-20migrate to git.ophivana.moe/security/fortifyOphestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-10-17ldd: run ldd with read-only filesystem and unshared netOphestra Umiker
This is only called on trusted programs, however extra hardening is never a bad idea. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-10-09ldd: separate Parse from Exec and trim spaceOphestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
generated by cgit v1.3.1 (git 2.54.0) at 2026-08-30 21:00:28 +0000