retoor/doos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Harden network helpers and compat-dir mounts per security review

Browse Source 
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
retoor
2026-10-24 00:45:27 +02:00
co-authored by Claude Sonnet 5
parent 4c4bb1a83a
commit 598a585eb8
53 changed files with 1151 additions and 80 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/RESEARCH.md
+5
View File
@@ -4,6 +4,11 @@
Measured on this machine: Ubuntu, kernel 7.0.0-38, AppArmor 5.0.2, slirp4netns 1.3.3, uid 1000, no root at runtime.
Memory-safety of doos's own code (not its behavior) is checked separately with `make valgrind`
against a fixed set of invocations; see [valgrind/README.md](../valgrind/README.md) for what it
covers and its suppressions. Known CVEs in software doos depends on or resembles are tracked in
[audit/README.md](../audit/README.md) (`make audit`).
## What works unprivileged
1. `clone(CLONE_NEWUSER|NEWNS|NEWPID|NEWUTS|NEWIPC[|NEWNET])`, then the parent writes `setgroups=deny`, `uid_map`, `gid_map` (single entry, own uid). No setuid helpers (`newuidmap`) needed.