rosa/hakurei
6
3
Fork 2
Code Issues 12 Pull Requests 2 Actions 2 Packages Projects Releases 15 Wiki Activity

container: skip landlock on hostnet
All checks were successful
Test / Create distribution (push) Successful in 1m34s
Details
Test / Sandbox (push) Successful in 3m46s
Details
Test / ShareFS (push) Successful in 5m0s
Details
Test / Sandbox (race detector) (push) Successful in 6m10s
Details
Test / Hakurei (race detector) (push) Successful in 7m29s
Details
Test / Hakurei (push) Successful in 3m21s
Details
Test / Flake checks (push) Successful in 1m43s
Details

Browse Source 
This overlaps with net namespace, so can be skipped without degrading security.

Signed-off-by: Ophestra <cat@gensokyo.uk>
This commit is contained in:
Ophestra
2026-04-07 14:36:44 +09:00
parent 10f8b1c221
commit c758e762bd
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
container/container.go
View File

@@ -324,9 +324,9 @@ func (p *Container) Start() error {
} }
if abi, err := LandlockGetABI(); err != nil { if abi, err := LandlockGetABI(); err != nil {
if p.HostAbstract { if p.HostAbstract || !p.HostNet {
// landlock can be skipped here as it restricts access // landlock can be skipped here as it restricts access
// to resources already covered by namespaces (pid) // to resources already covered by namespaces (pid, net)
goto landlockOut goto landlockOut
} }
return &StartError{Step: "get landlock ABI", Err: err} return &StartError{Step: "get landlock ABI", Err: err}