colin/nix-files
1
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

modules/programs: put things in a pid namespace by default

Browse Source
This commit is contained in:
Colin 2024-02-08 23:36:59 +00:00
parent c9af5bf9b4
commit 9ac0e0e4fc
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
modules/programs/sane-sandboxed
View File

@ -300,8 +300,11 @@ bwrapIngestCapability() {
# WIP
bwrapExec() {
# --unshare-pid: mean that the /proc mount does not expose /proc/$PID/ for every other process on the machine.
# --unshare-net creates a new net namespace with only the loopback interface.
# if `bwrapFlags` contains --share-net, thiss is canceled and the program sees an unsandboxed network.
PATH="$PATH:@bubblewrap@/bin" exec \
bwrap --unshare-net --dev /dev --proc /proc --tmpfs /tmp "${bwrapFlags[@]}" -- \
bwrap --unshare-net --unshare-pid --dev /dev --proc /proc --tmpfs /tmp "${bwrapFlags[@]}" -- \
"${cliArgs[@]}"
}