+7 -2

src/lib/shelter/runc.ml

reviewed

··· 71 71 (* Use chroot. *) 72 72 "CAP_KILL"; 73 73 (* Bypass permission checks for sending signals. *) 74 74 - "CAP_AUDIT_WRITE" 74 74 + "CAP_AUDIT_WRITE"; 75 75 (* Write records to kernel auditing log. *) 76 76 + "CAP_BPF"; 77 77 + "CAP_PERFMON"; 78 78 + (* BPF operations *) 76 79 (* Allowed by Docker, but disabled here (because we use host networking): 77 80 "CAP_NET_RAW"; (* Use RAW and PACKET sockets / bind to any address *) 78 81 "CAP_NET_BIND_SERVICE"; (* Bind a socket to Internet domain privileged ports. *) 79 79 - *); 82 82 + *) 80 83 ] 81 84 82 85 let seccomp_syscalls ~fast_sync = ··· 216 219 ~ty:"sysfs" ~src:"sysfs" 217 220 ~options:[ "nosuid"; "noexec"; "nodev"; "ro" ] 218 221 :: mount "/sys/fs/cgroup" ~ty:"cgroup" ~src:"cgroup" 222 222 + ~options:[ "ro"; "nosuid"; "noexec"; "nodev" ] 223 223 + :: mount "/sys/kernel/debug" ~ty:"debugfs" ~src:"debug" 219 224 ~options:[ "ro"; "nosuid"; "noexec"; "nodev" ] 220 225 :: mount "/dev/shm" ~ty:"tmpfs" ~src:"shm" 221 226 ~options:

-1

src/lib/shelter/store.ml

reviewed

··· 155 155 156 156 let with_tool t cid fn = 157 157 let ds = Datasets.tool t.pool (Cid.to_string cid) in 158 158 - Fun.protect ~finally:(fun () -> unmount_dataset t ds) @@ fun () -> 159 158 mount_dataset t ds; 160 159 fn ("/" ^ (ds :> string)) 161 160