mrtoth/agent-sandbox
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix read-only /dev, /proc, /tmp, /var/tmp, /run in blacklist mode

Browse Source
This commit is contained in:
Kristóf Tóth
2026-03-20 20:40:57 +01:00
parent c8e0d4813a
commit 50dafb4c37
1 changed files with 10 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
src/sandbox.rs
View File

@@ -22,9 +22,11 @@ pub fn build_command(config: &SandboxConfig) -> Result<Command, SandboxError> {
SandboxMode::Whitelist => add_whitelist_mode(&mut cmd)?, SandboxMode::Whitelist => add_whitelist_mode(&mut cmd)?,
} }
if hardened { if matches!(config.mode, SandboxMode::Whitelist) {
cmd.args(["--tmpfs", "/tmp"]); cmd.args(["--tmpfs", "/tmp"]);
cmd.args(["--tmpfs", "/var/tmp"]);
cmd.args(["--dev", "/dev"]); cmd.args(["--dev", "/dev"]);
cmd.args(["--tmpfs", "/dev/shm"]);
cmd.args(["--tmpfs", "/run"]); cmd.args(["--tmpfs", "/run"]);
cmd.args(["--proc", "/proc"]); cmd.args(["--proc", "/proc"]);
} }
@@ -62,6 +64,13 @@ fn add_blacklist_mode(cmd: &mut Command) -> Result<(), SandboxError> {
for file in &overlays.null_bind_files { for file in &overlays.null_bind_files {
cmd.arg("--ro-bind").arg("/dev/null").arg(file); cmd.arg("--ro-bind").arg("/dev/null").arg(file);
} }
cmd.args(["--dev-bind", "/dev", "/dev"]);
cmd.args(["--proc", "/proc"]);
cmd.args(["--bind", "/tmp", "/tmp"]);
cmd.args(["--bind", "/var/tmp", "/var/tmp"]);
cmd.args(["--bind", "/run", "/run"]);
Ok(()) Ok(())
} }