From b31d055e2087f95cb6172a67d8339a16d72987d3 Mon Sep 17 00:00:00 2001 From: Ophestra Date: Sat, 18 Jan 2025 12:23:07 +0900 Subject: proc/priv/init: early init check Signed-off-by: Ophestra --- internal/proc/priv/shim/main.go | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) (limited to 'internal/proc/priv/shim') diff --git a/internal/proc/priv/shim/main.go b/internal/proc/priv/shim/main.go index 3ade2868..85a425bf 100644 --- a/internal/proc/priv/shim/main.go +++ b/internal/proc/priv/shim/main.go @@ -125,14 +125,17 @@ func Main() { } // bind fortify inside sandbox - innerSbin := path.Join(fst.Tmp, "sbin") - fortifyInnerPath := path.Join(innerSbin, "fortify") - conf.Bind(proc.MustExecutable(), fortifyInnerPath) - conf.Symlink(fortifyInnerPath, path.Join(innerSbin, "init")) + var ( + innerSbin = path.Join(fst.Tmp, "sbin") + innerFortify = path.Join(innerSbin, "fortify") + innerInit = path.Join(innerSbin, "init") + ) + conf.Bind(proc.MustExecutable(), innerFortify) + conf.Symlink("fortify", innerInit) helper.BubblewrapName = payload.Exec[0] // resolved bwrap path by parent - if b, err := helper.NewBwrap(conf, nil, fortifyInnerPath, - func(int, int) []string { return []string{"init"} }); err != nil { + if b, err := helper.NewBwrap(conf, nil, innerInit, + func(int, int) []string { return make([]string, 0) }); err != nil { fmsg.Fatalf("malformed sandbox config: %v", err) } else { cmd := b.Unwrap() -- cgit v1.3.1