containers / containers/bubblewrap

Warning if used without --new-session

Open
#162 5 comments 2 reactions 0 assignees View on GitHub
bug enhancement
Dominant language
C
Stars
8.7k
Forks
386
Avg merge
3d 17h
Merged PRs (30d)
11

Description

With version 0.1.7 the unconditional call of setsid() has been replaced with the --new-session option and the hint to alternativly use seccomp filter to neutralize the TIOCSTI issue.

However i feel like this is somewhat risky, as few users will read the release notes and consequently use the new option. Using something like --no-new-session and calling setsid by default would be a more secure approach, but I suspect this is not wanted.

One idea to solve this would be to display a warning if bwrap is used without --new-session.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.