16 lines
577 B
C++
16 lines
577 B
C++
#pragma once
|
|
|
|
namespace doos {
|
|
|
|
// Confinement applied to every process that runs a container command, right before exec:
|
|
// 1. capability bounding set reduced to the Docker default set (spec::kKeptCaps),
|
|
// 2. a seccomp-bpf denylist (keyring, bpf, perf, userfaultfd, io_uring, mount family, kexec, module loading,
|
|
// nested user namespaces and the like), with an architecture check and x32 guard.
|
|
// Both need no_new_privs, which the caller sets. Throws when the filter cannot be installed.
|
|
class Hardening {
|
|
public:
|
|
static void apply();
|
|
};
|
|
|
|
} // namespace doos
|