INSTANCE_ATTR_USER,
INSTANCE_ATTR_STDOUT,
INSTANCE_ATTR_STDERR,
+ INSTANCE_ATTR_NO_NEW_PRIVS,
INSTANCE_ATTR_JAIL,
INSTANCE_ATTR_TRACE,
INSTANCE_ATTR_SECCOMP,
[INSTANCE_ATTR_USER] = { "user", BLOBMSG_TYPE_STRING },
[INSTANCE_ATTR_STDOUT] = { "stdout", BLOBMSG_TYPE_BOOL },
[INSTANCE_ATTR_STDERR] = { "stderr", BLOBMSG_TYPE_BOOL },
+ [INSTANCE_ATTR_NO_NEW_PRIVS] = { "no_new_privs", BLOBMSG_TYPE_BOOL },
[INSTANCE_ATTR_JAIL] = { "jail", BLOBMSG_TYPE_TABLE },
[INSTANCE_ATTR_TRACE] = { "trace", BLOBMSG_TYPE_BOOL },
[INSTANCE_ATTR_SECCOMP] = { "seccomp", BLOBMSG_TYPE_STRING },
argv[argc++] = in->seccomp;
}
+ if (in->no_new_privs)
+ argv[argc++] = "-c";
+
if (jail->procfs)
argv[argc++] = "-p";
if (tb[INSTANCE_ATTR_TRACE])
in->trace = blobmsg_get_bool(tb[INSTANCE_ATTR_TRACE]);
+ if (tb[INSTANCE_ATTR_NO_NEW_PRIVS])
+ in->no_new_privs = blobmsg_get_bool(tb[INSTANCE_ATTR_NO_NEW_PRIVS]);
+
if (!in->trace && tb[INSTANCE_ATTR_SECCOMP]) {
char *seccomp = blobmsg_get_string(tb[INSTANCE_ATTR_SECCOMP]);
struct stat s;
if (in->trace)
blobmsg_add_u8(b, "trace", true);
+ if (in->no_new_privs)
+ blobmsg_add_u8(b, "no_new_privs", true);
+
if (in->seccomp)
blobmsg_add_string(b, "seccomp", in->seccomp);