colin/nix-files
1
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

modules/programs: sandboxing: unshare ipc/cgroup/uts by default

Browse Source
This commit is contained in:
Colin 2024-02-14 01:48:59 +00:00
parent 2d7c5b9fa5
commit 548a95a7e1
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
modules/programs/sane-sandboxed
View File

@ -315,11 +315,16 @@ bwrapIngestCapability() {
# WIP
bwrapExec() {
# --unshare-all implies the following:
# --unshare-pid: mean that the /proc mount does not expose /proc/$PID/ for every other process on the machine.
# --unshare-net creates a new net namespace with only the loopback interface.
# if `bwrapFlags` contains --share-net, thiss is canceled and the program sees an unsandboxed network.
# --unshare-ipc
# --unshare-cgroup
# --unshare-uts
# --unshare-user (implicit to every non-suid call to bwrap)
PATH="$PATH:@bubblewrap@/bin" exec \
bwrap --unshare-net --unshare-pid --dev /dev --proc /proc --tmpfs /tmp "${bwrapFlags[@]}" -- \
bwrap --unshare-all --dev /dev --proc /proc --tmpfs /tmp "${bwrapFlags[@]}" -- \
"${cliArgs[@]}"
}