Skip to content
Permalink
Browse files Browse the repository at this point in the history
run: Don't allow unmounting filesystems
If we don't allow mounting filesystems, we shouldn't allow unmounting
either.

Partially fixes GHSA-67h7-w3jq-vh4q.

Signed-off-by: Simon McVittie <smcv@collabora.com>
  • Loading branch information
smcv authored and alexlarsson committed Oct 8, 2021
1 parent 4c34815 commit 1330662
Showing 1 changed file with 2 additions and 0 deletions.
2 changes: 2 additions & 0 deletions common/flatpak-run.c
Expand Up @@ -2934,6 +2934,8 @@ setup_seccomp (FlatpakBwrap *bwrap,
{SCMP_SYS (unshare), EPERM},
{SCMP_SYS (setns), EPERM},
{SCMP_SYS (mount), EPERM},
{SCMP_SYS (umount), EPERM},
{SCMP_SYS (umount2), EPERM},
{SCMP_SYS (pivot_root), EPERM},
#if defined(__s390__) || defined(__s390x__) || defined(__CRIS__)
/* Architectures with CONFIG_CLONE_BACKWARDS2: the child stack
Expand Down

0 comments on commit 1330662

Please sign in to comment.