Fix for CVE-2017-5226

StanislavNikolov · Aug 20, 2023 · 38f69b5 · 38f69b5
1 parent fb8d946
commit 38f69b5
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/backend/arena.ts b/backend/arena.ts
@@ -62,6 +62,12 @@ async function spawnBotProcess(tmpdir: string, hash: string) {
     "--ro-bind", dirname(dotnetBin), "/dotnet", // Mount the dotnet install directory
     "--ro-bind", tmpdir, "/fight",
     "--chdir", "/fight",
+
+    // Thanks to discord user Omsk for finding this!
+    // https://nvd.nist.gov/vuln/detail/CVE-2017-5226
+    // https://github.com/containers/bubblewrap/pull/560
+    "--new-session",
+
     "--unshare-all", // This disables practically everything, including reading other pids, network, etc.
     "--clearenv", // Do not leak any other env variable, not that they would help
     "--", "/dotnet/dotnet", `${hash}.dll` // Actually start the damn bot!