fix(ci): apply seccomp profile to run tarpaulin

buzztaiki · Jun 1, 2022 · 58ca1eb · 58ca1eb
1 parent d4e8a04
commit 58ca1eb
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 1 deletion.
diff --git a/.github/seccomp-profile.json b/.github/seccomp-profile.json
@@ -0,0 +1,17 @@
+{
+  "names": [
+    "personality"
+  ],
+  "action": "SCMP_ACT_ALLOW",
+  "args": [
+    {
+      "index": 0,
+      "value": 262144,
+      "valueTwo": 0,
+      "op": "SCMP_CMP_EQ"
+    }
+  ],
+  "comment": "Enable personality(ADDR_NO_RANDOMIZE) syscall",
+  "includes": {},
+  "excludes": {}
+}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -16,7 +16,9 @@ jobs:
           - archlinux:base-devel
           - ubuntu:22.04
     runs-on: ubuntu-latest
-    container: ${{ matrix.runner-image }}
+    container:
+      image: ${{ matrix.runner-image }}
+      options: --security-opt seccomp=.github/seccomp-profile.json
 
     steps:
       - uses: actions/checkout@v3