From 31aef905fa819310ee7694775a836c294ff742e4 Mon Sep 17 00:00:00 2001 From: Ophestra Date: Wed, 2 Jul 2025 04:38:28 +0900 Subject: sandbox: expose seccomp interface There's no point in artificially limiting and abstracting away these options. The higher level hakurei package is responsible for providing a secure baseline and sane defaults. The sandbox package should present everything to the caller. Signed-off-by: Ophestra --- dbus/proc.go | 1 + 1 file changed, 1 insertion(+) (limited to 'dbus/proc.go') diff --git a/dbus/proc.go b/dbus/proc.go index 1a519617..283f31c5 100644 --- a/dbus/proc.go +++ b/dbus/proc.go @@ -67,6 +67,7 @@ func (p *Proxy) Start() error { p.final, true, argF, func(container *sandbox.Container) { container.SeccompFlags |= seccomp.AllowMultiarch + container.SeccompPresets |= seccomp.PresetStrict container.Hostname = "hakurei-dbus" container.CommandContext = p.CommandContext if p.output != nil { -- cgit v1.3.1