colin/bubblewrap
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

README.md: Mention --new-session in section "Sandboxing"

Browse Source 
Signed-off-by: Sebastian Pipping <sebastian@pipping.org>
This commit is contained in:
Sebastian Pipping
2023-03-02 03:51:55 +01:00
committed by Alexander Larsson
parent 9a1d8b7217
commit 2f9ce900d4
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
README.md
View File

@@ -166,6 +166,11 @@ UTS namespace ([CLONE_NEWUTS](http://linux.die.net/man/2/clone)): The sandbox wi
Seccomp filters: You can pass in seccomp filters that limit which syscalls can be done in the sandbox. For more information, see [Seccomp](https://en.wikipedia.org/wiki/Seccomp).
If you are not filtering out `TIOCSTI` commands using seccomp filters,
argument `--new-session` is needed to protect against out-of-sandbox
command execution
(see [CVE-2017-5226](https://github.com/containers/bubblewrap/issues/142)).
Related project comparison: Firejail
------------------------------------