From 31aef905fa819310ee7694775a836c294ff742e4 Mon Sep 17 00:00:00 2001 From: Ophestra Date: Wed, 2 Jul 2025 04:38:28 +0900 Subject: sandbox: expose seccomp interface There's no point in artificially limiting and abstracting away these options. The higher level hakurei package is responsible for providing a secure baseline and sane defaults. The sandbox package should present everything to the caller. Signed-off-by: Ophestra --- sandbox/init.go | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) (limited to 'sandbox/init.go') diff --git a/sandbox/init.go b/sandbox/init.go index 2fa84e64..2cd7f6c1 100644 --- a/sandbox/init.go +++ b/sandbox/init.go @@ -229,8 +229,18 @@ func Init(prepare func(prefix string), setVerbose func(verbose bool)) { log.Fatalf("cannot capset: %v", err) } - if err := seccomp.Load(seccomp.Preset(params.Flags.seccomp(params.SeccompPresets), params.SeccompFlags), params.SeccompFlags); err != nil { - log.Fatalf("cannot load syscall filter: %v", err) + if !params.SeccompDisable { + rules := params.SeccompRules + if len(rules) == 0 { // non-empty rules slice always overrides presets + msg.Verbosef("resolving presets %#x", params.SeccompPresets) + rules = seccomp.Preset(params.SeccompPresets, params.SeccompFlags) + } + if err := seccomp.Load(rules, params.SeccompFlags); err != nil { + log.Fatalf("cannot load syscall filter: %v", err) + } + msg.Verbosef("%d filter rules loaded", len(rules)) + } else { + msg.Verbose("syscall filter not configured") } extraFiles := make([]*os.File, params.Count) -- cgit v1.3.1