|
|
0ba8be659f
|
sandbox: document less obvious parts of setup
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
2025-04-01 01:21:04 +09:00 |
|
|
|
184e9db2b2
|
sandbox: support privileged container
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
2025-03-27 19:40:19 +09:00 |
|
|
|
d613257841
|
sandbox/init: clear inheritable set
Inheritable should not be able to affect anything regardless of its value, due to no_new_privs.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
2025-03-26 07:46:13 +09:00 |
|
|
|
52fcc48ac1
|
sandbox/init: drop capabilities
During development the syscall filter caused me to make an incorrect assumption about SysProcAttr.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
2025-03-26 06:32:08 +09:00 |
|
|
|
971c79bb80
|
sandbox: remove hardcoded parent perm
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
2025-03-25 19:49:51 +09:00 |
|
|
|
ad3576c164
|
sandbox: resolve tty name
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
2025-03-24 16:03:07 +09:00 |
|
|
|
b74a08dda9
|
sandbox: prepare ops early
Some setup code needs to run in host root. This change allows that to happen.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
2025-03-18 02:17:46 +09:00 |
|
|
|
1b9408864f
|
sandbox: pass cmd to cancel function
This is not usually in scope otherwise.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
2025-03-17 22:36:39 +09:00 |
|
|
|
d7eddd54a2
|
sandbox: rename params struct
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
2025-03-17 21:45:08 +09:00 |
|
|
|
af3619d440
|
sandbox: create symlinks
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
2025-03-17 16:37:56 +09:00 |
|
|
|
528674cb6e
|
sandbox/init: fail early on nil op
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
2025-03-17 16:17:03 +09:00 |
|
|
|
24618ab9a1
|
sandbox: move out of internal
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
2025-03-17 02:55:36 +09:00 |
|
