diff options
| author | Nicolas Lacasse <nlacasse@google.com> | 2018-09-07 10:15:34 -0700 |
|---|---|---|
| committer | Shentubot <shentubot@google.com> | 2018-09-07 10:16:39 -0700 |
| commit | 210c2520890ea48d551c0c9fffe890a7c60fb802 (patch) | |
| tree | 4f431b5737cd9e6a7c8c33e459242c3404eab7c0 /runsc/sandbox/BUILD | |
| parent | 590d8320992d74e54e2c095c68c49abc2b23dcbe (diff) | |
runsc: Run sandbox process inside minimal chroot.
We construct a dir with the executable bind-mounted at /exe, and proc mounted
at /proc. Runsc now executes the sandbox process inside this chroot, thus
limiting access to the host filesystem. The mounts and chroot dir are removed
when the sandbox is destroyed.
Because this requires bind-mounts, we can only do the chroot if we have
CAP_SYS_ADMIN.
PiperOrigin-RevId: 211994001
Change-Id: Ia71c515e26085e0b69b833e71691830148bc70d1
Diffstat (limited to 'runsc/sandbox/BUILD')
| -rw-r--r-- | runsc/sandbox/BUILD | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/runsc/sandbox/BUILD b/runsc/sandbox/BUILD index 9317b1c14..8ebd14c4e 100644 --- a/runsc/sandbox/BUILD +++ b/runsc/sandbox/BUILD @@ -5,6 +5,7 @@ load("@io_bazel_rules_go//go:def.bzl", "go_library") go_library( name = "sandbox", srcs = [ + "chroot.go", "network.go", "sandbox.go", ], |