security/fortify
2
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 35 Wiki Activity

sandbox/mount: pass absolute path
All checks were successful
Test / Create distribution (push) Successful in 24s
Details
Test / Fortify (push) Successful in 2m31s
Details
Test / Fpkg (push) Successful in 3m24s
Details
Test / Data race detector (push) Successful in 4m6s
Details
Test / Flake checks (push) Successful in 48s
Details

Browse Source 
This should never be used unless there is a good reason to, like using a file in the intermediate root.

Signed-off-by: Ophestra <cat@gensokyo.uk>
This commit is contained in:
Ophestra 2025-03-17 21:53:31 +09:00
parent 816b372f14
commit 07181138e5
Signed by: cat
SSH Key Fingerprint: SHA256:gQ67O0enBZ7UdZypgtspB2FDM1g3GVw8nX0XSdcFw8Q
2 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
sandbox/mount.go
View File

@ -11,9 +11,11 @@ import (
const ( const (
BindOptional = 1 << iota BindOptional = 1 << iota
BindSource BindSource
BindRecursive
BindWritable BindWritable
BindDevice BindDevice
bindAbsolute
bindRecursive
) )
func bindMount(src, dest string, flags int) error { func bindMount(src, dest string, flags int) error {
@ -39,6 +41,8 @@ func bindMount(src, dest string, flags int) error {
} else if flags&BindOptional != 0 { } else if flags&BindOptional != 0 {
return msg.WrapErr(syscall.EINVAL, return msg.WrapErr(syscall.EINVAL,
"flag source excludes optional") "flag source excludes optional")
} else if flags&bindAbsolute != 0 {
source = src
} else { } else {
source = toHost(src) source = toHost(src)
} }
@ -60,7 +64,7 @@ func bindMount(src, dest string, flags int) error {
} }
var mf uintptr = syscall.MS_SILENT | syscall.MS_BIND var mf uintptr = syscall.MS_SILENT | syscall.MS_BIND
if flags&BindRecursive != 0 { if flags&bindRecursive != 0 {
mf |= syscall.MS_REC mf |= syscall.MS_REC
} }
if flags&BindWritable == 0 { if flags&BindWritable == 0 {

2
sandbox/sequential.go
View File

@ -36,7 +36,7 @@ func (b *BindMount) String() string {
return fmt.Sprintf("%q on %q flags %#x", b.Source, b.Target, b.Flags&BindWritable) return fmt.Sprintf("%q on %q flags %#x", b.Source, b.Target, b.Flags&BindWritable)
} }
func (f *Ops) Bind(source, target string, flags int) *Ops { func (f *Ops) Bind(source, target string, flags int) *Ops {
*f = append(*f, &BindMount{source, target, flags | BindRecursive}) *f = append(*f, &BindMount{source, target, flags | bindRecursive})
return f return f
} }