From c6381932684a45aff6c187d53e5568bf52444457 Mon Sep 17 00:00:00 2001 From: Ophestra Date: Sun, 23 Mar 2025 05:27:57 +0900 Subject: sandbox: apply vfs options to bind mounts Signed-off-by: Ophestra --- sandbox/path.go | 25 +++++++++++++++++++++---- 1 file changed, 21 insertions(+), 4 deletions(-) (limited to 'sandbox/path.go') diff --git a/sandbox/path.go b/sandbox/path.go index 5a28bdf9..78c5a995 100644 --- a/sandbox/path.go +++ b/sandbox/path.go @@ -9,6 +9,8 @@ import ( "strconv" "strings" "syscall" + + "git.gensokyo.uk/security/fortify/sandbox/vfs" ) const ( @@ -64,14 +66,29 @@ func ensureFile(name string, perm os.FileMode) error { var hostProc = newProcPats(hostPath) func newProcPats(prefix string) *procPaths { - return &procPaths{prefix, prefix + "/self", prefix + "/self/mountinfo"} + return &procPaths{prefix + "/proc", prefix + "/proc/self"} } type procPaths struct { - prefix string - self string - mountinfo string + prefix string + self string } func (p *procPaths) stdout() string { return p.self + "/fd/1" } func (p *procPaths) fd(fd int) string { return p.self + "/fd/" + strconv.Itoa(fd) } +func (p *procPaths) mountinfo(f func(d *vfs.MountInfoDecoder) error) error { + if r, err := os.Open(p.self + "/mountinfo"); err != nil { + return msg.WrapErr(err, err.Error()) + } else { + d := vfs.NewMountInfoDecoder(r) + err0 := f(d) + if err = r.Close(); err != nil { + return wrapErrSuffix(err, + "cannot close mountinfo:") + } else if err = d.Err(); err != nil { + return wrapErrSuffix(err, + "cannot parse mountinfo:") + } + return err0 + } +} -- cgit v1.3.1