Skip to content

Commit 1330662

Browse files
smcvalexlarsson
authored andcommitted
run: Don't allow unmounting filesystems
If we don't allow mounting filesystems, we shouldn't allow unmounting either. Partially fixes GHSA-67h7-w3jq-vh4q. Signed-off-by: Simon McVittie <smcv@collabora.com>
1 parent 4c34815 commit 1330662

File tree

1 file changed

+2
-0
lines changed

1 file changed

+2
-0
lines changed

Diff for: common/flatpak-run.c

+2
Original file line numberDiff line numberDiff line change
@@ -2934,6 +2934,8 @@ setup_seccomp (FlatpakBwrap *bwrap,
29342934
{SCMP_SYS (unshare), EPERM},
29352935
{SCMP_SYS (setns), EPERM},
29362936
{SCMP_SYS (mount), EPERM},
2937+
{SCMP_SYS (umount), EPERM},
2938+
{SCMP_SYS (umount2), EPERM},
29372939
{SCMP_SYS (pivot_root), EPERM},
29382940
#if defined(__s390__) || defined(__s390x__) || defined(__CRIS__)
29392941
/* Architectures with CONFIG_CLONE_BACKWARDS2: the child stack

0 commit comments

Comments
 (0)