security-and-privacy/mat2
security-and-privacy/mat2
1
0
Fork 0
mirror of synced 2024-11-22 09:14:23 +01:00
Code Releases Activity

Streamline a bit the previous commit

Browse Source
This commit is contained in:
jvoisin 2019-02-09 15:23:16 +01:00
parent a71488d459
commit 6e63e03b86
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libmat2/subprocess.py
View File

@ -32,22 +32,26 @@ def _get_bwrap_path() -> str:
def _get_bwrap_args(tempdir: str, def _get_bwrap_args(tempdir: str,
input_filename: str, input_filename: str,
output_filename: Optional[str] = None) -> List[str]: output_filename: Optional[str] = None) -> List[str]:
ro_bind_args = []
cwd = os.getcwd() cwd = os.getcwd()
# XXX: use --ro-bind-try once all supported platforms # XXX: use --ro-bind-try once all supported platforms
# have a bubblewrap recent enough to support it. # have a bubblewrap recent enough to support it.
ro_bind_dirs = ['/usr', '/lib', '/lib64', '/bin', '/sbin', cwd] ro_bind_dirs = ['/usr', '/lib', '/lib64', '/bin', '/sbin', cwd]
ro_bind_args = []
for bind_dir in ro_bind_dirs: for bind_dir in ro_bind_dirs:
if os.path.isdir(bind_dir): # pragma: no cover if os.path.isdir(bind_dir): # pragma: no cover
ro_bind_args.extend(['--ro-bind', bind_dir, bind_dir]) ro_bind_args.extend(['--ro-bind', bind_dir, bind_dir])
ro_bind_files = ['/etc/ld.so.cache']
for bind_file in ro_bind_files:
if os.path.isfile(bind_file): # pragma: no cover
ro_bind_args.extend(['--ro-bind', bind_file, bind_file])
args = ro_bind_args + \ args = ro_bind_args + \
['--dev', '/dev', ['--dev', '/dev',
'--chdir', cwd, '--chdir', cwd,
'--unshare-all', '--unshare-all',
'--new-session', '--new-session',
'--ro-bind', '/etc/ld.so.cache', '/etc/ld.so.cache',
# XXX: enable --die-with-parent once all supported platforms have # XXX: enable --die-with-parent once all supported platforms have
# a bubblewrap recent enough to support it. # a bubblewrap recent enough to support it.
# '--die-with-parent', # '--die-with-parent',