mirror of
https://github.com/hanzoai/visor.git
synced 2026-09-24 17:04:14 +00:00
Etienne Perot
3ebcc06dc0
This verifies that a running Sentry (`runsc boot`) process's host kernel state matches the state we expect it to be once it starts running untrusted code. Useful for defense-in-depth, and to assert that future startup optimizations do not regress gVisor's security. Updates issue #13718.
23 lines
563 B
Python
23 lines
563 B
Python
load("//tools:defs.bzl", "go_library")
|
|
|
|
package(
|
|
default_applicable_licenses = ["//:license"],
|
|
licenses = ["notice"],
|
|
)
|
|
|
|
go_library(
|
|
name = "sandboxposture",
|
|
testonly = 1,
|
|
srcs = [
|
|
"expected.go",
|
|
"sandboxposture.go",
|
|
],
|
|
visibility = ["//:sandbox"],
|
|
deps = [
|
|
"@com_github_google_go_cmp//cmp:go_default_library",
|
|
"@com_github_google_go_cmp//cmp/cmpopts:go_default_library",
|
|
"@com_github_moby_sys_capability//:go_default_library",
|
|
"@org_golang_x_sys//unix:go_default_library",
|
|
],
|
|
)
|