security-and-privacy/mat2
security-and-privacy/mat2
1
0
Fork 0
mirror of synced 2024-11-24 18:24:23 +01:00
Code Releases Activity

Mount a new tmpfs on /tmp and drop all capabilities

Browse Source 
This mounts a new tmpfs on /tmp so any files residing there would be hidden
from the sandbox. Many programs store some files in there that might be useful
to an attacker.  It also drops all capabilities incase it is ever run with
extra capabilities for whatever reason.
This commit is contained in:
madaidan 2019-09-21 06:33:49 -07:00 committed by jvoisin
parent 3714553185
commit 58773088ac
2 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.gitlab-ci.yml
View File

@ -16,7 +16,7 @@ linting:bandit:
script: # TODO: remove B405 and B314 script: # TODO: remove B405 and B314
- bandit ./mat2 --format txt --skip B101 - bandit ./mat2 --format txt --skip B101
- bandit -r ./nautilus/ --format txt --skip B101 - bandit -r ./nautilus/ --format txt --skip B101
- bandit -r ./libmat2 --format txt --skip B101,B404,B603,B405,B314 - bandit -r ./libmat2 --format txt --skip B101,B404,B603,B405,B314,B108
linting:codespell: linting:codespell:
image: $CONTAINER_REGISTRY:linting image: $CONTAINER_REGISTRY:linting

2
libmat2/subprocess.py
View File

@ -51,6 +51,7 @@ def _get_bwrap_args(tempdir: str,
['--dev', '/dev', ['--dev', '/dev',
'--proc', '/proc', '--proc', '/proc',
'--chdir', cwd, '--chdir', cwd,
'--tmpfs', '/tmp',
'--unshare-user-try', '--unshare-user-try',
'--unshare-ipc', '--unshare-ipc',
'--unshare-pid', '--unshare-pid',
@ -58,6 +59,7 @@ def _get_bwrap_args(tempdir: str,
'--unshare-uts', '--unshare-uts',
'--unshare-cgroup-try', '--unshare-cgroup-try',
'--new-session', '--new-session',
'--cap-drop', 'all',
# XXX: enable --die-with-parent once all supported platforms have # XXX: enable --die-with-parent once all supported platforms have
# a bubblewrap recent enough to support it. # a bubblewrap recent enough to support it.
# '--die-with-parent', # '--die-with-parent',