mirror/flatpak
1
0
Fork 0
mirror of https://github.com/flatpak/flatpak.git synced 2026-07-01 19:57:01 -04:00
Code Issues Packages Projects Releases Wiki Activity

run: Don't allow unmounting filesystems

Browse Source 
If we don't allow mounting filesystems, we shouldn't allow unmounting
either.

Partially fixes GHSA-67h7-w3jq-vh4q.

Signed-off-by: Simon McVittie <smcv@collabora.com>
This commit is contained in:
Simon McVittie
2021-09-01 14:20:29 +01:00
committed by Alexander Larsson
parent aacfed4b0b
commit 8fc2d96393
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
common/flatpak-run.c
View File

@@ -2825,6 +2825,8 @@ setup_seccomp (FlatpakBwrap *bwrap,
{SCMP_SYS (unshare), EPERM},
{SCMP_SYS (setns), EPERM},
{SCMP_SYS (mount), EPERM},
{SCMP_SYS (umount), EPERM},
{SCMP_SYS (umount2), EPERM},
{SCMP_SYS (pivot_root), EPERM},
#if defined(__s390__) || defined(__s390x__) || defined(__CRIS__)
/* Architectures with CONFIG_CLONE_BACKWARDS2: the child stack