mirror/runc
1
0
Fork 0
mirror of https://github.com/opencontainers/runc.git synced 2026-07-11 06:03:57 +08:00
Code Issues Packages Projects Releases Wiki Activity

contrib: memfd-bind: add helper for memfd-sealed-bind trick

Browse Source 
This really isn't ideal but it can be used to avoid the largest issues
with the memfd-based runc binary protection. There are several caveats
with using this tool, see the help page for the new binary for details.

Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
This commit is contained in:
Aleksa Sarai
2023-07-11 22:20:48 +10:00
parent dac4171746
commit b9a4727f54
6 changed files with 330 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Makefile
+4 -3
View File
@@ -67,9 +67,9 @@ runc: runc-dmz
$(GO_BUILD) -o runc .
make verify-dmz-arch
all: runc recvtty sd-helper seccompagent fs-idmap
all: runc recvtty sd-helper seccompagent fs-idmap memfd-bind
recvtty sd-helper seccompagent fs-idmap:
recvtty sd-helper seccompagent fs-idmap memfd-bind:
$(GO_BUILD) -o contrib/cmd/$@/$@ ./contrib/cmd/$@
static: runc-dmz
@@ -161,10 +161,11 @@ install-man: man
clean:
rm -f runc runc-* libcontainer/dmz/runc-dmz
rm -f contrib/cmd/fs-idmap/fs-idmap
rm -f contrib/cmd/recvtty/recvtty
rm -f contrib/cmd/sd-helper/sd-helper
rm -f contrib/cmd/seccompagent/seccompagent
rm -f contrib/cmd/fs-idmap/fs-idmap
rm -f contrib/cmd/memfd-bind/memfd-bind
sudo rm -rf release
rm -rf man/man8