containers / containers/bubblewrap
Warning if used without --new-session
Open
bug
enhancement
- Dominant language
- C
- Stars
- 8.7k
- Forks
- 386
- Avg merge
- 3d 17h
- Merged PRs (30d)
- 11
Description
With version 0.1.7 the unconditional call of setsid() has been replaced with the --new-session option and the hint to alternativly use seccomp filter to neutralize the TIOCSTI issue.
However i feel like this is somewhat risky, as few users will read the release notes and consequently use the new option. Using something like --no-new-session and calling setsid by default would be a more secure approach, but I suspect this is not wanted.
One idea to solve this would be to display a warning if bwrap is used without --new-session.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.