shoenig / nomad-pledge-driver

Nomad task driver capable of blocking unwanted syscall and filesystem access. Based on the pledge utility for Linux by Justine Tunney
Mozilla Public License 2.0
22 stars 2 forks source link

use TMPDIR instead of HOME #3

Closed shoenig closed 2 years ago

shoenig commented 2 years ago

The pledge binary searches TMPDIR before using HOME as a fallback; the dance we do with ensuring a HOME directory actually exists (i.e. for service users) should be unnecessary, as we can set TMPDIR to something reasonable ourselves.