From 37780456a75c08652bd191d0e9c2bb9077198dc4 Mon Sep 17 00:00:00 2001 From: Ophestra Date: Sat, 25 Jan 2025 12:35:47 +0900 Subject: helper: block more unusual/privileged syscalls These are toggled by F_EXT and exposed as SyscallPolicy.Compat in the Go interface. Signed-off-by: Ophestra --- helper/bwrap/seccomp.go | 1 + 1 file changed, 1 insertion(+) (limited to 'helper/bwrap/seccomp.go') diff --git a/helper/bwrap/seccomp.go b/helper/bwrap/seccomp.go index abc2738b..f77abc66 100644 --- a/helper/bwrap/seccomp.go +++ b/helper/bwrap/seccomp.go @@ -30,6 +30,7 @@ type ( ) const ( + flagExt syscallOpts = C.F_EXT flagDenyNS syscallOpts = C.F_DENY_NS flagDenyTTY syscallOpts = C.F_DENY_TTY flagDenyDevel syscallOpts = C.F_DENY_DEVEL -- cgit v1.3.1