security/fortify
2
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 25 Wiki Activity

ldd: enable syscall filter
All checks were successful
Build / Create distribution (push) Successful in 1m55s
Details
Test / Run NixOS test (push) Successful in 4m6s
Details

Browse Source 
Signed-off-by: Ophestra <cat@gensokyo.uk>
This commit is contained in:
Ophestra 2025-01-22 02:00:49 +09:00
parent a30f5e1226
commit 5a64cdaf4f
Signed by: cat
SSH Key Fingerprint: SHA256:gQ67O0enBZ7UdZypgtspB2FDM1g3GVw8nX0XSdcFw8Q
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
ldd/exec.go
View File

@ -20,6 +20,7 @@ func Exec(p string) ([]*Entry, error) {
(&bwrap.Config{ (&bwrap.Config{
Hostname: "fortify-ldd", Hostname: "fortify-ldd",
Chdir: "/", Chdir: "/",
Syscall: &bwrap.SyscallPolicy{DenyDevel: true, Multiarch: true},
NewSession: true, NewSession: true,
DieWithParent: true, DieWithParent: true,
}).Bind("/", "/").DevTmpfs("/dev"), "ldd", }).Bind("/", "/").DevTmpfs("/dev"), "ldd",