security/fortify
2
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 35 Wiki Activity

sandbox/mount: rename device flag
All checks were successful
Test / Create distribution (push) Successful in 25s
Details
Test / Fortify (push) Successful in 2m28s
Details
Test / Fpkg (push) Successful in 3m30s
Details
Test / Data race detector (push) Successful in 4m5s
Details
Test / Flake checks (push) Successful in 51s
Details

Browse Source 
Signed-off-by: Ophestra <cat@gensokyo.uk>
This commit is contained in:
Ophestra 2025-03-17 16:10:55 +09:00
parent c83a7e2efc
commit 70c9757e26
Signed by: cat
SSH Key Fingerprint: SHA256:gQ67O0enBZ7UdZypgtspB2FDM1g3GVw8nX0XSdcFw8Q
2 changed files with 4 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
sandbox/mount.go
View File

@ -13,7 +13,7 @@ const (
BindSource
BindRecursive
BindWritable
BindDevices
BindDevice
)
func bindMount(src, dest string, flags int) error {
@ -66,7 +66,7 @@ func bindMount(src, dest string, flags int) error {
if flags&BindWritable == 0 {
mf |= syscall.MS_RDONLY
}
if flags&BindDevices == 0 {
if flags&BindDevice == 0 {
mf |= syscall.MS_NODEV
}
if msg.IsVerbose() {

7
sandbox/sequential.go
View File

@ -89,7 +89,7 @@ func (d MountDev) apply(params *InitParams) error {
for _, name := range []string{"null", "zero", "full", "random", "urandom", "tty"} {
if err := bindMount(
"/dev/"+name, path.Join(v, name),
BindSource|BindDevices,
BindSource|BindDevice,
); err != nil {
return err
}
@ -132,10 +132,7 @@ func (d MountDev) apply(params *InitParams) error {
syscall.SYS_IOCTL, 1, syscall.TIOCGWINSZ,
uintptr(unsafe.Pointer(&buf[0])),
); errno == 0 {
if err := bindMount(
"/proc/self/fd/1", path.Join(v, "console"),
BindDevices,
); err != nil {
if err := bindMount("/proc/self/fd/1", path.Join(v, "console"), BindDevice); err != nil {
return err
}
}