diff options
| author | Dmitry Vyukov <dvyukov@google.com> | 2016-07-01 22:20:47 +0200 |
|---|---|---|
| committer | Dmitry Vyukov <dvyukov@google.com> | 2016-07-01 22:26:33 +0200 |
| commit | 4782c2b8e6d9cf4c75612c444760060d0a103da3 (patch) | |
| tree | 36b9bed2d0cc53e6a08508563c16f014c803a6aa /executor/syscalls.h | |
| parent | e4f88bd25b5d83b4b25ee63135b9618b238be837 (diff) | |
executor: revive setuid sandbox
The new namespace-based sanboxing is good,
but it's not always what one wants
(and also requires special kernel configs).
Change dropprivs config value to sandbox,
which can have different values (currently: none, setuid, namespace).
Setuid mode uses setuid(nobody) before fuzzing as before.
In future we can add more sandboxing modes or, say,
extend -sandbox=setuid to -sandbox=setuid:johndoe
to impersonolate into given user.
Diffstat (limited to 'executor/syscalls.h')
0 files changed, 0 insertions, 0 deletions