containers / containers/bubblewrap
PR_SET_DUMPABLE
Open
- Dominant language
- C
- Stars
- 8.7k
- Forks
- 386
- Avg merge
- 3d 17h
- Merged PRs (30d)
- 11
Description
In some sandboxed applications like the example code in libseccomp the PR_SET_DUMPABLE is set to 0 to prevent escape via ptrace
However here https://github.com/containers/bubblewrap/blob/1f7e2ad948c051054b683461885a0215f1806240/bubblewrap.c#L852
bubblewrap is set as traceable instead.
Why is this? If I am not mistaken, this recent issue https://github.com/containers/bubblewrap/security/advisories/GHSA-j2qp-rvxj-43vj would have been prevented if this value was set to 0 instead.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.