From 73b0f8b7d45f2e1ceb003fff006dc4ab6d419058 Mon Sep 17 00:00:00 2001 From: Etienne Perot Date: Fri, 9 Aug 2024 17:17:57 -0700 Subject: [PATCH] Disable gVisor's DirectFS feature. DirectFS is enabled by default in gVisor to improve I/O performance, but comes at the cost of enabling the `openat(2)` syscall (with severe restrictions, but still). As Dangerzone is not performance-sensitive, and that it is desirable to guarantee for the document conversion process to not open any files (to mimic some of what SELinux provides), might as well disable it by default. See #226. --- dangerzone/gvisor_wrapper/entrypoint.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/dangerzone/gvisor_wrapper/entrypoint.py b/dangerzone/gvisor_wrapper/entrypoint.py index f9941ed..8d09eb2 100755 --- a/dangerzone/gvisor_wrapper/entrypoint.py +++ b/dangerzone/gvisor_wrapper/entrypoint.py @@ -142,6 +142,9 @@ runsc_argv = [ "--rootless=true", "--network=none", "--root=/home/dangerzone/.containers", + # Disable DirectFS for to make the seccomp filter even stricter, + # at some performance cost. + "--directfs=false", ] if os.environ.get("RUNSC_DEBUG"): runsc_argv += ["--debug=true", "--alsologtostderr=true"]