maemachinebroke/hakurei
1
0
Fork 0
forked from security/hakurei
Code Pull Requests Activity

container: enforce nonrepeatable autoetc and autoroot

Browse Source 
These keep track of some internal state, and they don't make sense to have multiple instances of anyway, so instead of dealing with that, just make them nonrepetable.

Signed-off-by: Ophestra <cat@gensokyo.uk>
This commit is contained in:
Ophestra
2025-08-17 01:43:11 +09:00
parent 8aa65f28c6
commit 9c1a5d43ba
3 changed files with 18 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
container/autoroot.go
View File

@@ -56,6 +56,11 @@ func (r *AutoRootOp) early(state *setupState) error {
}
func (r *AutoRootOp) apply(state *setupState) error {
if state.nonrepeatable&nrAutoRoot != 0 {
return msg.WrapErr(syscall.EINVAL, "autoroot is not repeatable")
}
state.nonrepeatable |= nrAutoRoot
for _, op := range r.resolved {
msg.Verbosef("%s %s", op.prefix(), op)
if err := op.apply(state); err != nil {