mrtoth/agent-sandbox
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix blacklist bind mount order

Browse Source
This commit is contained in:
Kristóf Tóth
2026-03-20 21:02:48 +01:00
parent 826c6d5531
commit 94535b20d3
2 changed files with 32 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
src/sandbox.rs
View File

@@ -57,6 +57,12 @@ fn add_blacklist_mode(cmd: &mut Command) -> Result<(), SandboxError> {
let ctx = blacklist::resolve_path_context()?;
cmd.args(["--ro-bind", "/", "/"]);
cmd.args(["--dev-bind", "/dev", "/dev"]);
cmd.args(["--proc", "/proc"]);
cmd.args(["--bind", "/tmp", "/tmp"]);
cmd.args(["--bind", "/var/tmp", "/var/tmp"]);
cmd.args(["--bind", "/run", "/run"]);
let overlays = blacklist::resolve_overlays(&ctx)?;
for dir in &overlays.tmpfs_dirs {
cmd.arg("--tmpfs").arg(dir);
@@ -65,12 +71,6 @@ fn add_blacklist_mode(cmd: &mut Command) -> Result<(), SandboxError> {
cmd.arg("--ro-bind").arg("/dev/null").arg(file);
}
cmd.args(["--dev-bind", "/dev", "/dev"]);
cmd.args(["--proc", "/proc"]);
cmd.args(["--bind", "/tmp", "/tmp"]);
cmd.args(["--bind", "/var/tmp", "/var/tmp"]);
cmd.args(["--bind", "/run", "/run"]);
Ok(())
}