lfg2025/archy
1
0
Fork 0
Code Issues 16 Pull Requests 2 Actions Packages Projects Releases 44 Wiki Activity

fix: enforce no-new-privileges on all container creation

Browse Source 
The manifest field was validated but never applied to the podman create
command. Now passes --security-opt no-new-privileges=true for all containers.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Dorian 2026-03-11 19:06:59 +00:00
parent 367763e2fe
commit fd2a837bea
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
core/container/src/podman_client.rs
View File

@ -177,6 +177,9 @@ impl PodmanClient {
cmd.arg("--cap-add").arg(cap); cmd.arg("--cap-add").arg(cap);
} }
// Enforce no new privileges (prevent setuid escalation)
cmd.arg("--security-opt").arg("no-new-privileges=true");
// Image // Image
cmd.arg(&manifest.app.container.image); cmd.arg(&manifest.app.container.image);