From 94895bbacb42b82673b07142e786855a8ac756dc Mon Sep 17 00:00:00 2001 From: Ophestra Date: Fri, 14 Mar 2025 02:38:32 +0900 Subject: sandbox: invert seccomp ruleset defaults Signed-off-by: Ophestra --- internal/sandbox/container.go | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) (limited to 'internal/sandbox/container.go') diff --git a/internal/sandbox/container.go b/internal/sandbox/container.go index 4f8be1df..de71f372 100644 --- a/internal/sandbox/container.go +++ b/internal/sandbox/container.go @@ -20,12 +20,20 @@ import ( type HardeningFlags uintptr const ( - FAllowUserns HardeningFlags = 1 << iota + FSyscallCompat HardeningFlags = 1 << iota + FAllowDevel + FAllowUserns FAllowTTY FAllowNet ) func (flags HardeningFlags) seccomp(opts seccomp.SyscallOpts) seccomp.SyscallOpts { + if flags&FSyscallCompat == 0 { + opts |= seccomp.FlagExt + } + if flags&FAllowDevel == 0 { + opts |= seccomp.FlagDenyDevel + } if flags&FAllowUserns == 0 { opts |= seccomp.FlagDenyNS } -- cgit v1.3.1