From 562f5ed7971603a4e4e3315a7fe4188153bfc205 Mon Sep 17 00:00:00 2001 From: Ophestra Date: Wed, 15 Jan 2025 10:07:51 +0900 Subject: fst: hide sockets exposed via Filesystem This is mostly useful for permissive defaults. Signed-off-by: Ophestra --- internal/app/seal.go | 19 +------------------ 1 file changed, 1 insertion(+), 18 deletions(-) (limited to 'internal/app/seal.go') diff --git a/internal/app/seal.go b/internal/app/seal.go index 27663771..a67feb45 100644 --- a/internal/app/seal.go +++ b/internal/app/seal.go @@ -194,7 +194,6 @@ func (a *app) Seal(config *fst.Config) error { switch p { case "/proc": case "/dev": - case "/run": case "/tmp": case "/mnt": case "/etc": @@ -205,23 +204,7 @@ func (a *app) Seal(config *fst.Config) error { } conf.Filesystem = append(conf.Filesystem, b...) } - // bind entries in /run - if d, err := a.os.ReadDir("/run"); err != nil { - return err - } else { - b := make([]*fst.FilesystemConfig, 0, len(d)) - for _, ent := range d { - name := ent.Name() - switch name { - case "user": - case "dbus": - default: - p := "/run/" + name - b = append(b, &fst.FilesystemConfig{Src: p, Write: true, Must: true}) - } - } - conf.Filesystem = append(conf.Filesystem, b...) - } + // hide nscd from sandbox if present nscd := "/var/run/nscd" if _, err := a.os.Stat(nscd); !errors.Is(err, fs.ErrNotExist) { -- cgit v1.3.1