From be76c7ce6eb8f2a76c876b500aefc6f0fd8e30ba Mon Sep 17 00:00:00 2001 From: Fabricio Voznika Date: Wed, 19 Aug 2020 18:35:35 -0700 Subject: Move boot.Config to its own package Updates #3494 PiperOrigin-RevId: 327548511 --- website/blog/2019-11-18-security-basics.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'website/blog') diff --git a/website/blog/2019-11-18-security-basics.md b/website/blog/2019-11-18-security-basics.md index 76bbabc13..2256ee9d5 100644 --- a/website/blog/2019-11-18-security-basics.md +++ b/website/blog/2019-11-18-security-basics.md @@ -188,7 +188,7 @@ for direct access to some files. And most files will be remotely accessed through the Gofers, in which case no FDs are donated to the Sentry. The Sentry itself is only allowed access to specific -[whitelisted syscalls](https://github.com/google/gvisor/blob/master/runsc/boot/config.go). +[whitelisted syscalls](https://github.com/google/gvisor/blob/master/runsc/config/config.go). Without networking, the Sentry needs 53 host syscalls in order to function, and with networking, it uses an additional 15[^8]. By limiting the whitelist to only these needed syscalls, we radically reduce the amount of host OS attack surface. -- cgit v1.2.3