From 8a725d8a66ef1c38b256c52c1865e5000cc8ca36 Mon Sep 17 00:00:00 2001 From: Fabricio Voznika Date: Wed, 19 Aug 2020 18:35:35 -0700 Subject: Move boot.Config to its own package Updates #3494 PiperOrigin-RevId: 327548511 --- website/blog/2019-11-18-security-basics.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'website/blog') diff --git a/website/blog/2019-11-18-security-basics.md b/website/blog/2019-11-18-security-basics.md index 76bbabc13..2256ee9d5 100644 --- a/website/blog/2019-11-18-security-basics.md +++ b/website/blog/2019-11-18-security-basics.md @@ -188,7 +188,7 @@ for direct access to some files. And most files will be remotely accessed through the Gofers, in which case no FDs are donated to the Sentry. The Sentry itself is only allowed access to specific -[whitelisted syscalls](https://github.com/google/gvisor/blob/master/runsc/boot/config.go). +[whitelisted syscalls](https://github.com/google/gvisor/blob/master/runsc/config/config.go). Without networking, the Sentry needs 53 host syscalls in order to function, and with networking, it uses an additional 15[^8]. By limiting the whitelist to only these needed syscalls, we radically reduce the amount of host OS attack surface. -- cgit v1.2.3