container: optionally isolate host abstract UNIX domain sockets via landlock

2025-08-18 12:00:52 +09:00
parent 69a4ab8105
commit 5db0714072
17 changed files with 375 additions and 9 deletions
--- a/internal/app/seal_linux.go
+++ b/internal/app/seal_linux.go
@@ -238,10 +238,11 @@ func (seal *outcome) finalise(ctx context.Context, sys sys.State, config *hst.Co
 		}

 		conf := &hst.ContainerConfig{
-			Userns:  true,
-			Net:     true,
-			Tty:     true,
-			AutoEtc: true,
+			Userns:   true,
+			Net:      true,
+			Abstract: true,
+			Tty:      true,
+			AutoEtc:  true,

 			AutoRoot:  container.AbsFHSRoot,
 			RootFlags: container.BindWritable,