mii/izoli
1
0
Fork 0
mirror of https://github.com/mii443/izoli.git synced 2025-08-22 16:05:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

mount procfs readonly to prevent breakout

Browse Source
This commit is contained in:
mii
2024-11-04 11:32:51 +09:00
parent 8346a7165f
commit c442169036
2 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
src/bin/izoli.rs
View File

@ -42,6 +42,7 @@ fn main() {
Mount::new("/lib64", "/lib64", true, false), Mount::new("/lib64", "/lib64", true, false),
Mount::new("/usr/lib", "/usr/lib", true, false), Mount::new("/usr/lib", "/usr/lib", true, false),
Mount::new("/usr/lib64", "/usr/lib64", true, false), Mount::new("/usr/lib64", "/usr/lib64", true, false),
Mount::new("/etc", "/etc", true, true),
], ],
}, },
); );

2
src/izolibox.rs
View File

@ -112,7 +112,7 @@ impl IzoliBox {
let mounts = [ let mounts = [
("tmp", Some("tmpfs"), MsFlags::empty()), ("tmp", Some("tmpfs"), MsFlags::empty()),
("proc", Some("proc"), MsFlags::empty()), ("proc", Some("proc"), MsFlags::MS_RDONLY),
]; ];
for (target, source, flags) in mounts.iter() { for (target, source, flags) in mounts.iter() {