Github/nsjail
1
0
Fork 0
mirror of https://github.com/google/nsjail.git synced 2026-08-30 18:41:30 -07:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #283 from h1-mrz/harden-proc-mount-flags

Browse Source 
mnt: mount the auto-provisioned /proc nosuid,nodev,noexec
This commit is contained in:
robertswiecki
2026-08-26 20:36:43 +02:00
committed by GitHub
parent fc38d1257a d01bfe3602
commit b0d163391c
1 changed files with 11 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
cmdline.cc
View File

@@ -480,6 +480,17 @@ static bool setupMounts(nsj_t* nsj) {
p->set_fstype("proc"); p->set_fstype("proc");
p->set_rw(nsj->is_proc_rw); p->set_rw(nsj->is_proc_rw);
p->set_is_dir(true); p->set_is_dir(true);
/*
* Mount the auto-provisioned procfs nosuid+nodev+noexec, matching the
* convention used by every other container runtime (runc, Docker,
* systemd-nspawn). There is no legitimate reason for /proc to honor
* setuid bits, expose device nodes, or allow execution, and doing so
* needlessly widens the in-jail attack surface (e.g. a setuid binary
* or device node reachable via a procfs path).
*/
p->set_nosuid(true);
p->set_nodev(true);
p->set_noexec(true);
} }
return true; return true;