security/fortify
2
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 35 Wiki Activity

sandbox/mount: rename device flag
All checks were successful
Test / Create distribution (push) Successful in 25s
Details
Test / Fortify (push) Successful in 2m28s
Details
Test / Fpkg (push) Successful in 3m30s
Details
Test / Data race detector (push) Successful in 4m5s
Details
Test / Flake checks (push) Successful in 51s
Details

Browse Source 
Signed-off-by: Ophestra <cat@gensokyo.uk>
This commit is contained in:
Ophestra 2025-03-17 16:10:55 +09:00
parent c83a7e2efc
commit 70c9757e26
Signed by: cat
SSH Key Fingerprint: SHA256:gQ67O0enBZ7UdZypgtspB2FDM1g3GVw8nX0XSdcFw8Q
2 changed files with 4 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
sandbox/mount.go
View File

@ -13,7 +13,7 @@ const (
BindSource BindSource
BindRecursive BindRecursive
BindWritable BindWritable
BindDevices BindDevice
) )
func bindMount(src, dest string, flags int) error { func bindMount(src, dest string, flags int) error {
@ -66,7 +66,7 @@ func bindMount(src, dest string, flags int) error {
if flags&BindWritable == 0 { if flags&BindWritable == 0 {
mf |= syscall.MS_RDONLY mf |= syscall.MS_RDONLY
} }
if flags&BindDevices == 0 { if flags&BindDevice == 0 {
mf |= syscall.MS_NODEV mf |= syscall.MS_NODEV
} }
if msg.IsVerbose() { if msg.IsVerbose() {

7
sandbox/sequential.go
View File

@ -89,7 +89,7 @@ func (d MountDev) apply(params *InitParams) error {
for _, name := range []string{"null", "zero", "full", "random", "urandom", "tty"} { for _, name := range []string{"null", "zero", "full", "random", "urandom", "tty"} {
if err := bindMount( if err := bindMount(
"/dev/"+name, path.Join(v, name), "/dev/"+name, path.Join(v, name),
BindSource|BindDevices, BindSource|BindDevice,
); err != nil { ); err != nil {
return err return err
} }
@ -132,10 +132,7 @@ func (d MountDev) apply(params *InitParams) error {
syscall.SYS_IOCTL, 1, syscall.TIOCGWINSZ, syscall.SYS_IOCTL, 1, syscall.TIOCGWINSZ,
uintptr(unsafe.Pointer(&buf[0])), uintptr(unsafe.Pointer(&buf[0])),
); errno == 0 { ); errno == 0 {
if err := bindMount( if err := bindMount("/proc/self/fd/1", path.Join(v, "console"), BindDevice); err != nil {
"/proc/self/fd/1", path.Join(v, "console"),
BindDevices,
); err != nil {
return err return err
} }
} }