maemachinebroke/hakurei
1
0
Fork 0
forked from security/hakurei
Code Pull Requests Activity

container: optionally isolate host abstract UNIX domain sockets via landlock

Browse Source
This commit is contained in:
Clayton Gilmer
2025-08-18 12:00:52 +09:00
committed by Ophestra
parent 69a4ab8105
commit 5db0714072
17 changed files with 375 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
test/sandbox/case/device.nix
View File

@@ -243,7 +243,7 @@ in
seccomp = true;
try_socket = "/tmp/.X11-unix/X0";
socket_abstract = true;
socket_abstract = false;
socket_pathname = true;
};
}

2
test/sandbox/case/mapuid.nix
View File

@@ -269,7 +269,7 @@ in
seccomp = true;
try_socket = "/tmp/.X11-unix/X0";
socket_abstract = true;
socket_abstract = false;
socket_pathname = false;
};
}

4
test/sandbox/case/pd.nix
View File

@@ -194,5 +194,9 @@
];
seccomp = true;
try_socket = "/tmp/.X11-unix/X0";
socket_abstract = true;
socket_pathname = false;
};
}

2
test/sandbox/case/pdlike.nix
View File

@@ -264,7 +264,7 @@ in
seccomp = true;
try_socket = "/tmp/.X11-unix/X0";
socket_abstract = true;
socket_abstract = false;
socket_pathname = false;
};
}

2
test/sandbox/case/preset.nix
View File

@@ -262,7 +262,7 @@ in
seccomp = true;
try_socket = "/tmp/.X11-unix/X0";
socket_abstract = true;
socket_abstract = false;
socket_pathname = false;
};
}

2
test/sandbox/case/tty.nix
View File

@@ -275,7 +275,7 @@ in
seccomp = true;
try_socket = "/tmp/.X11-unix/X0";
socket_abstract = true;
socket_abstract = false;
socket_pathname = true;
};
}