security/fortify
2
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 35 Wiki Activity

sandbox/mount: pass custom tmpfs name
All checks were successful
Test / Create distribution (push) Successful in 27s
Details
Test / Fortify (push) Successful in 2m51s
Details
Test / Data race detector (push) Successful in 3m53s
Details
Test / Fpkg (push) Successful in 3m59s
Details
Test / Flake checks (push) Successful in 55s
Details

Browse Source 
The tmpfs driver allows arbitrary fsname.

Signed-off-by: Ophestra <cat@gensokyo.uk>
This commit is contained in:
Ophestra 2025-03-14 02:12:35 +09:00
parent a092b042ab
commit 2eff470091
Signed by: cat
SSH Key Fingerprint: SHA256:gQ67O0enBZ7UdZypgtspB2FDM1g3GVw8nX0XSdcFw8Q
2 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
internal/sandbox/mount.go
View File

@ -82,7 +82,7 @@ func bindMount(src, dest string, flags int) error {
fmt.Sprintf("cannot bind %q on %q:", src, dest)) fmt.Sprintf("cannot bind %q on %q:", src, dest))
} }
func mountTmpfs(name string, size int, perm os.FileMode) error { func mountTmpfs(fsname, name string, size int, perm os.FileMode) error {
target := toSysroot(name) target := toSysroot(name)
if err := os.MkdirAll(target, perm); err != nil { if err := os.MkdirAll(target, perm); err != nil {
return err return err
@ -91,7 +91,7 @@ func mountTmpfs(name string, size int, perm os.FileMode) error {
if size > 0 { if size > 0 {
opt += fmt.Sprintf(",size=%d", size) opt += fmt.Sprintf(",size=%d", size)
} }
return fmsg.WrapErrorSuffix(syscall.Mount("tmpfs", target, "tmpfs", return fmsg.WrapErrorSuffix(syscall.Mount(fsname, target, "tmpfs",
syscall.MS_NOSUID|syscall.MS_NODEV, opt), syscall.MS_NOSUID|syscall.MS_NODEV, opt),
fmt.Sprintf("cannot mount tmpfs on %q:", name)) fmt.Sprintf("cannot mount tmpfs on %q:", name))
} }

2
internal/sandbox/sequential.go
View File

@ -87,7 +87,7 @@ func (t *MountTmpfs) apply(*InitParams) error {
return fmsg.WrapError(syscall.EBADE, return fmsg.WrapError(syscall.EBADE,
fmt.Sprintf("size %d out of bounds", t.Size)) fmt.Sprintf("size %d out of bounds", t.Size))
} }
return mountTmpfs(t.Path, t.Size, t.Perm) return mountTmpfs("tmpfs", t.Path, t.Size, t.Perm)
} }
func (t *MountTmpfs) Is(op Op) bool { vt, ok := op.(*MountTmpfs); return ok && *t == *vt } func (t *MountTmpfs) Is(op Op) bool { vt, ok := op.(*MountTmpfs); return ok && *t == *vt }