From 37780456a75c08652bd191d0e9c2bb9077198dc4 Mon Sep 17 00:00:00 2001 From: Ophestra Date: Sat, 25 Jan 2025 12:35:47 +0900 Subject: helper: block more unusual/privileged syscalls These are toggled by F_EXT and exposed as SyscallPolicy.Compat in the Go interface. Signed-off-by: Ophestra --- helper/bwrap/seccomp-resolve.go | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) (limited to 'helper/bwrap/seccomp-resolve.go') diff --git a/helper/bwrap/seccomp-resolve.go b/helper/bwrap/seccomp-resolve.go index 995a3719..01df4dcc 100644 --- a/helper/bwrap/seccomp-resolve.go +++ b/helper/bwrap/seccomp-resolve.go @@ -9,10 +9,17 @@ import ( ) type SyscallPolicy struct { + // disable fortify extensions + Compat bool `json:"compat"` + // deny development syscalls DenyDevel bool `json:"deny_devel"` + // deny multiarch/emulation syscalls Multiarch bool `json:"multiarch"` - Linux32 bool `json:"linux32"` - Can bool `json:"can"` + // allow PER_LINUX32 + Linux32 bool `json:"linux32"` + // allow AF_CAN + Can bool `json:"can"` + // allow AF_BLUETOOTH Bluetooth bool `json:"bluetooth"` } @@ -53,6 +60,7 @@ func (c *Config) resolveSeccomp() (*os.File, error) { o syscallOpts d string }{ + {!c.Syscall.Compat, flagExt, "fortify"}, {!c.UserNS, flagDenyNS, "denyns"}, {c.NewSession, flagDenyTTY, "denytty"}, {c.Syscall.DenyDevel, flagDenyDevel, "denydevel"}, -- cgit v1.3.1