mirror of
https://github.com/criyle/go-sandbox.git
synced 2025-11-04 14:49:53 +08:00
66 lines
1.3 KiB
Go
66 lines
1.3 KiB
Go
// +build linux
|
|
|
|
package forkexec
|
|
|
|
import (
|
|
"golang.org/x/sys/unix"
|
|
)
|
|
|
|
// defines missing consts from syscall package
|
|
const (
|
|
SECCOMP_SET_MODE_STRICT = 0
|
|
SECCOMP_SET_MODE_FILTER = 1
|
|
SECCOMP_FILTER_FLAG_TSYNC = 1
|
|
|
|
// Unshare flags
|
|
UnshareFlags = unix.CLONE_NEWIPC | unix.CLONE_NEWNET | unix.CLONE_NEWNS |
|
|
unix.CLONE_NEWPID | unix.CLONE_NEWUSER | unix.CLONE_NEWUTS | unix.CLONE_NEWCGROUP
|
|
|
|
// Read-only bind mount need to be remounted
|
|
bindRo = unix.MS_BIND | unix.MS_RDONLY
|
|
)
|
|
|
|
// used by unshare remount / to private
|
|
var (
|
|
none = []byte("none\000")
|
|
slash = []byte("/\000")
|
|
empty = []byte("\000")
|
|
tmpfs = []byte("tmpfs\000")
|
|
|
|
// tmp dir made by pivot_root
|
|
oldRoot = []byte("old_root\000")
|
|
|
|
// set groups for unshare user
|
|
setGIDAllow = []byte("allow")
|
|
setGIDDeny = []byte("deny")
|
|
|
|
// go does not allow constant uintptr to be negative...
|
|
_AT_FDCWD = unix.AT_FDCWD
|
|
|
|
// Drop all capabilities
|
|
dropCapHeader = unix.CapUserHeader{
|
|
Version: unix.LINUX_CAPABILITY_VERSION_3,
|
|
Pid: 0,
|
|
}
|
|
|
|
dropCapData = unix.CapUserData{
|
|
Effective: 0,
|
|
Permitted: 0,
|
|
Inheritable: 0,
|
|
}
|
|
)
|
|
|
|
const (
|
|
_SECURE_NOROOT = 1 << iota
|
|
_SECURE_NOROOT_LOCKED
|
|
|
|
_SECURE_NO_SETUID_FIXUP
|
|
_SECURE_NO_SETUID_FIXUP_LOCKED
|
|
|
|
_SECURE_KEEP_CAPS
|
|
_SECURE_KEEP_CAPS_LOCKED
|
|
|
|
_SECURE_NO_CAP_AMBIENT_RAISE
|
|
_SECURE_NO_CAP_AMBIENT_RAISE_LOCKED
|
|
)
|