From 5db07140726e6e1bf615ed075e9a8b653508c2a7 Mon Sep 17 00:00:00 2001 From: Clayton Gilmer Date: Mon, 18 Aug 2025 12:00:52 +0900 Subject: container: optionally isolate host abstract UNIX domain sockets via landlock --- internal/app/seal_linux.go | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) (limited to 'internal/app/seal_linux.go') diff --git a/internal/app/seal_linux.go b/internal/app/seal_linux.go index c7293720..0ae121fb 100644 --- a/internal/app/seal_linux.go +++ b/internal/app/seal_linux.go @@ -238,10 +238,11 @@ func (seal *outcome) finalise(ctx context.Context, sys sys.State, config *hst.Co } conf := &hst.ContainerConfig{ - Userns: true, - Net: true, - Tty: true, - AutoEtc: true, + Userns: true, + Net: true, + Abstract: true, + Tty: true, + AutoEtc: true, AutoRoot: container.AbsFHSRoot, RootFlags: container.BindWritable, -- cgit v1.3.1