summaryrefslogtreecommitdiff
path: root/libmat2/subprocess.py (follow)
AgeCommit message (Collapse)Author
2019-10-12Add a way to disable the sandboxjvoisin
Due to bubblewrap's pickiness, mat2 can now be run without a sandbox, even if bubblewrap is installed.
2019-10-05Mount a new tmpfs on /tmp and drop all capabilitiesmadaidan
This mounts a new tmpfs on /tmp so any files residing there would be hidden from the sandbox. Many programs store some files in there that might be useful to an attacker. It also drops all capabilities incase it is ever run with extra capabilities for whatever reason.
2019-09-21Fix bubblewrapjvoisin
On some machines (like mine), `/proc` has to be mounted. Also, since sandboxing with bubblewrap is best effort and assumes that an attacker doesn't have control outside of the file to clean, it's safe to __try__ to enable some bubblewrap features, and to silently fail otherwise.
2019-02-09Streamline a bit the previous commitjvoisin
2019-02-09bind mount /etc/ld.so.cache to the sandboxPoncho
without /etc/ld.so.cache available in the sandbox, tests fail on gentoo with: /usr/bin/ffmpeg: error while loading shared libraries: libstdc++.so.6: cannot open shared object file: No such file or directory
2019-02-03Whenever possible, use bwrap for subprocessesintrigeri
This should closes #90