External/pmg
1
0
Fork 0
mirror of https://github.com/safedep/pmg.git synced 2026-08-03 07:24:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: Refactor bwrap sandbox to use common dangerous files

Browse Source
This commit is contained in:
Abhisek Datta
2026-01-14 21:25:27 +05:30
parent 0eec922a15
commit eeaac7c3bc
6 changed files with 57 additions and 116 deletions
Download Patch File Download Diff File Expand all files Collapse all files
sandbox/platform/bubblewrap_translator_linux.go
+7 -7
View File
@@ -158,13 +158,13 @@ func (t *bubblewrapPolicyTranslator) addIsolationNamespaces(policy *sandbox.Sand
// - Paths not mounted are inaccessible (deny-by-default)
//
// Strategy:
// 1. Start with essential system paths (added separately)
// 2. Add user-specified allow_read paths FIRST (read-only bind mounts)
// This establishes the base filesystem view (e.g., "/" for full access)
// 3. Add user-specified allow_write paths SECOND (read-write bind mounts)
// These OVERRIDE earlier read-only binds (bwrap: later mounts win)
// 4. Handle deny patterns by mounting /dev/null or read-only for directories
// 5. Add mandatory deny patterns
// 1. Start with essential system paths (added separately)
// 2. Add user-specified allow_read paths FIRST (read-only bind mounts)
// This establishes the base filesystem view (e.g., "/" for full access)
// 3. Add user-specified allow_write paths SECOND (read-write bind mounts)
// These OVERRIDE earlier read-only binds (bwrap: later mounts win)
// 4. Handle deny patterns by mounting /dev/null or read-only for directories
// 5. Add mandatory deny patterns
func (t *bubblewrapPolicyTranslator) translateFilesystem(policy *sandbox.SandboxPolicy) ([]string, error) {
args := []string{}