trending/OpenShell
1
0
Fork 0
mirror of https://github.com/NVIDIA/OpenShell.git synced 2026-11-13 11:45:58 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(isolation): harden runtime boundary controls

Browse Source 
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
This commit is contained in:
Drew Newberry
2026-09-11 15:12:15 -07:00
parent 9d0038f979
commit 1f20080b15
2 changed files with 42 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/openshell-isolation-interface/src/linux/child_seccomp.rs
+13
View File
@@ -193,6 +193,7 @@ pub fn prepare(sandbox_tgid: u32) -> io::Result<ChildHardeningProgram> {
for syscall in [
libc::SYS_prlimit64,
libc::SYS_sched_setaffinity,
libc::SYS_sched_setattr,
libc::SYS_sched_setparam,
libc::SYS_sched_setscheduler,
] {
@@ -418,6 +419,18 @@ mod tests {
{
unsafe { libc::_exit(5) };
}
if unsafe {
libc::syscall(
libc::SYS_sched_setattr,
sandbox_tgid,
std::ptr::null::<libc::c_void>(),
0,
)
} != -1
|| io::Error::last_os_error().raw_os_error() != Some(libc::EPERM)
{
unsafe { libc::_exit(11) };
}
if unsafe { libc::fcntl(libc::STDIN_FILENO, libc::F_SETOWN, sandbox_tgid) } != -1
|| io::Error::last_os_error().raw_os_error() != Some(libc::EPERM)
{