2019-08-11 20:10:38 +02:00
|
|
|
#ifndef SANDBOXLINUX_H
|
|
|
|
|
#define SANDBOXLINUX_H
|
|
|
|
|
#include <memory>
|
|
|
|
|
#include <vector>
|
|
|
|
|
#include "sandbox.h"
|
|
|
|
|
class SandboxLinux : public Sandbox
|
|
|
|
|
{
|
|
|
|
|
public:
|
|
|
|
|
using Sandbox::Sandbox;
|
|
|
|
|
bool supported() override;
|
|
|
|
|
bool enableForInit() override;
|
|
|
|
|
bool enablePreWorker(std::vector<std::string> fsPaths) override;
|
|
|
|
|
bool enableForWorker() override;
|
|
|
|
|
|
|
|
|
|
private:
|
|
|
|
|
bool isolateNamespaces(std::vector<std::string> fsPaths);
|
|
|
|
|
bool seccomp_blacklist(std::initializer_list<int> syscalls);
|
2019-08-21 20:14:44 +02:00
|
|
|
bool bindMountPaths(std::string target_root, const std::vector<std::string> &paths);
|
2019-08-11 20:10:38 +02:00
|
|
|
};
|
|
|
|
|
#endif
|
