From 877fb29635370f3ebbdfd0211460bc66347269ea Mon Sep 17 00:00:00 2001 From: aszlig Date: Fri, 11 Sep 2020 18:34:13 +0200 Subject: sandbox: Allow to enable/disable namespaces While the sandbox was initially written for games, I now use the implementation for other things, such as sandboxing database management systems inside "nix develop". However, both MariaDB and PostgreSQL do not like it very much if for example IPC is too restricted and if the PID file contains the PID of the process inside the namespace. Additionally I always wanted to have a way to enable network namespaces for games as well, so this is a good occasion to make them configurable. Of course, since we need the mount and user namespaces to implement our sandbox in the first place, we can't allow users to disable these namespaces, but for everything else, we now have a new "namespaces" attribute. Signed-off-by: aszlig --- pkgs/build-support/build-sandbox/src/setup.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) (limited to 'pkgs/build-support/build-sandbox/src/setup.c') diff --git a/pkgs/build-support/build-sandbox/src/setup.c b/pkgs/build-support/build-sandbox/src/setup.c index 98205710..dc8bbf14 100644 --- a/pkgs/build-support/build-sandbox/src/setup.c +++ b/pkgs/build-support/build-sandbox/src/setup.c @@ -850,8 +850,7 @@ bool setup_sandbox(void) close(sync_pipe[0]); _exit(write_maps(parent_pid) ? 0 : 1); default: - if (unshare(CLONE_NEWNS | CLONE_NEWUSER | CLONE_NEWPID | - CLONE_NEWUTS | CLONE_NEWIPC) == -1) { + if (unshare(CLONE_NEWNS | CLONE_NEWUSER | EXTRA_NS_FLAGS) == -1) { perror("unshare"); if (write(sync_pipe[1], "X", 1) == -1) perror("signal child exit"); -- cgit 1.4.1