diff options
Diffstat (limited to 'runsc/sandbox')
| -rw-r--r-- | runsc/sandbox/chroot.go | 2 | ||||
| -rw-r--r-- | runsc/sandbox/sandbox.go | 1 |
2 files changed, 2 insertions, 1 deletions
diff --git a/runsc/sandbox/chroot.go b/runsc/sandbox/chroot.go index 30a4bae35..35b19a0b1 100644 --- a/runsc/sandbox/chroot.go +++ b/runsc/sandbox/chroot.go @@ -55,7 +55,7 @@ func setUpChroot() (string, error) { log.Infof("Setting up sandbox chroot in %q", chroot) // Mount /proc. - if err := mountInChroot(chroot, "proc", "/proc", "proc", 0); err != nil { + if err := mountInChroot(chroot, "proc", "/proc", "proc", syscall.MS_NOSUID|syscall.MS_NODEV|syscall.MS_NOEXEC); err != nil { return "", fmt.Errorf("error mounting proc in chroot: %v", err) } diff --git a/runsc/sandbox/sandbox.go b/runsc/sandbox/sandbox.go index 1ed1ab61d..847417a15 100644 --- a/runsc/sandbox/sandbox.go +++ b/runsc/sandbox/sandbox.go @@ -475,6 +475,7 @@ func (s *Sandbox) createSandboxProcess(spec *specs.Spec, conf *boot.Config, bund } s.Chroot = chroot // Remember path so it can cleaned up. cmd.SysProcAttr.Chroot = chroot + cmd.Dir = "/" cmd.Args[0] = "/runsc" cmd.Path = "/runsc" } else { |