Sandboxes: Make /tmp writeable to restore POSIX compliancy

kit-ty-kate · Aug 15, 2023 · d4bfed9 · d4bfed9
1 parent 8cc4a37
commit d4bfed9
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 0 deletions.
diff --git a/src/state/shellscripts/bwrap.sh b/src/state/shellscripts/bwrap.sh
@@ -19,6 +19,7 @@ fi
 ARGS=(--unshare-net --new-session --die-with-parent)
 ARGS=("${ARGS[@]}" --proc /proc --dev /dev)
 ARGS=("${ARGS[@]}" --setenv TMPDIR /opam-tmp --setenv TMP /opam-tmp --setenv TEMPDIR /opam-tmp --setenv TEMP /opam-tmp)
+ARGS=("${ARGS[@]}" --tmpfs /tmp)
 ARGS=("${ARGS[@]}" --tmpfs /opam-tmp)
 ARGS=("${ARGS[@]}" --tmpfs /run)
 # NOTE: When adding a new mount-point please sync with the loop below to avoid overriding the mount point

diff --git a/src/state/shellscripts/sandbox_exec.sh b/src/state/shellscripts/sandbox_exec.sh
@@ -7,6 +7,7 @@ set -ue
 POL='(version 1)(allow default)(deny network*)(deny file-write*)'
 POL="$POL"'(allow network* (remote unix))'
 POL="$POL"'(allow file-write* (literal "/dev/null") (literal "/dev/dtracehelper"))'
+POL="$POL"'(allow file-write* (literal "/tmp"))'
 
 add_mounts() {
     if [ -d "$2" ]; then