2 ms·
My guess is that seccomp blacklisting file access should be enough. It wouldn't be too hard to patch graphviz to disallow file access. And/or containerising it
by leni536 10y ago
My guess is that seccomp blacklisting file access should be enough. It wouldn't be too hard to patch graphviz to disallow file access. And/or containerising it to only have write/read access inside a single, dedicated folder.
- ellson 10y agoGraphviz has code to restrict file access when used in a web server. Its in lib/common/utils.c:safefile() But to be honest, a container approach would probably be better today.