From 5db07140726e6e1bf615ed075e9a8b653508c2a7 Mon Sep 17 00:00:00 2001 From: Clayton Gilmer Date: Mon, 18 Aug 2025 12:00:52 +0900 Subject: container: optionally isolate host abstract UNIX domain sockets via landlock --- system/dbus/proc.go | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'system') diff --git a/system/dbus/proc.go b/system/dbus/proc.go index 0e5f1cef..6607ef19 100644 --- a/system/dbus/proc.go +++ b/system/dbus/proc.go @@ -64,6 +64,10 @@ func (p *Proxy) Start() error { argF, func(z *container.Container) { z.SeccompFlags |= seccomp.AllowMultiarch z.SeccompPresets |= seccomp.PresetStrict + + // xdg-dbus-proxy fails with scoped abstract unix sockets despite pathname socket being available + z.HostAbstract = true + z.Hostname = "hakurei-dbus" if p.output != nil { z.Stdout, z.Stderr = p.output, p.output -- cgit v1.3.1