Seth Hoenig 05937ab75b exec2: add client support for unveil filesystem isolation mode (#20115) ...

* exec2: add client support for unveil filesystem isolation mode

This PR adds support for a new filesystem isolation mode, "Unveil". The
mode introduces a "alloc_mounts" directory where tasks have user-owned
directory structure which are bind mounts into the real alloc directory
structure. This enables a task driver to use landlock (and maybe the
real unveil on openbsd one day) to isolate a task to the task owned
directory structure, providing sandboxing.

* actually create alloc-mounts-dir directory

* fix doc strings about alloc mount dir paths

2024-03-13 08:24:17 -05:00

..

driver_test.go

Add OOM detection for exec driver (#19563)

2024-01-03 09:50:27 -06:00

driver_unix_test.go

drivers: plumb hardware topology via grpc into drivers (#18504)

2023-09-18 08:58:07 -05:00

driver.go

exec2: add client support for unveil filesystem isolation mode (#20115)

2024-03-13 08:24:17 -05:00

handle.go

Add OOM detection for exec driver (#19563)

2024-01-03 09:50:27 -06:00

state.go

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:15 -05:00