app: mount /dev/kvm in permissive defaults
Signed-off-by: Ophestra <cat@gensokyo.uk>
This commit is contained in:
parent
aecfae1874
commit
f608f28a6a
@ -100,6 +100,7 @@ var testCasesPd = []sealTestCase{
|
||||
Bind("/run/wrappers", "/run/wrappers", false, true).
|
||||
Bind("/run/zed.pid", "/run/zed.pid", false, true).
|
||||
Bind("/run/zed.state", "/run/zed.state", false, true).
|
||||
Bind("/dev/kvm", "/dev/kvm", true, true, true).
|
||||
Bind("/etc", fst.Tmp+"/etc").
|
||||
Symlink(fst.Tmp+"/etc/alsa", "/etc/alsa").
|
||||
Symlink(fst.Tmp+"/etc/bashrc", "/etc/bashrc").
|
||||
@ -355,6 +356,7 @@ var testCasesPd = []sealTestCase{
|
||||
Bind("/run/zed.pid", "/run/zed.pid", false, true).
|
||||
Bind("/run/zed.state", "/run/zed.state", false, true).
|
||||
Bind("/dev/dri", "/dev/dri", true, true, true).
|
||||
Bind("/dev/kvm", "/dev/kvm", true, true, true).
|
||||
Bind("/etc", fst.Tmp+"/etc").
|
||||
Symlink(fst.Tmp+"/etc/alsa", "/etc/alsa").
|
||||
Symlink(fst.Tmp+"/etc/bashrc", "/etc/bashrc").
|
||||
|
@ -201,6 +201,8 @@ func (a *app) Seal(config *fst.Config) error {
|
||||
if config.Confinement.Enablements.Has(system.EX11) || config.Confinement.Enablements.Has(system.EWayland) {
|
||||
conf.Filesystem = append(conf.Filesystem, &fst.FilesystemConfig{Src: "/dev/dri", Device: true})
|
||||
}
|
||||
// opportunistically bind kvm
|
||||
conf.Filesystem = append(conf.Filesystem, &fst.FilesystemConfig{Src: "/dev/kvm", Device: true})
|
||||
|
||||
config.Confinement.Sandbox = conf
|
||||
}
|
||||
|
Loading…
Reference in New Issue
Block a user