github.com/drone/runner-go@v1.12.0/container/volume.go (about) 1 // Copyright 2021 Drone.IO Inc. All rights reserved. 2 // Use of this source code is governed by the Polyform License 3 // that can be found in the LICENSE file. 4 5 package container 6 7 import ( 8 "path/filepath" 9 "strings" 10 ) 11 12 // IsRestrictedVolume is helper function that 13 // returns true if mounting the volume is restricted for un-trusted containers. 14 func IsRestrictedVolume(path string) bool { 15 path, err := filepath.Abs(path) 16 if err != nil { 17 return true 18 } 19 20 path = strings.ToLower(path) 21 22 switch { 23 case path == "/": 24 case path == "/etc": 25 case path == "/etc/docker" || strings.HasPrefix(path, "/etc/docker/"): 26 case path == "/var": 27 case path == "/var/run" || strings.HasPrefix(path, "/var/run/"): 28 case path == "/proc" || strings.HasPrefix(path, "/proc/"): 29 case path == "/usr/local/bin" || strings.HasPrefix(path, "/usr/local/bin/"): 30 case path == "/usr/local/sbin" || strings.HasPrefix(path, "/usr/local/sbin/"): 31 case path == "/usr/bin" || strings.HasPrefix(path, "/usr/bin/"): 32 case path == "/bin" || strings.HasPrefix(path, "/bin/"): 33 case path == "/mnt" || strings.HasPrefix(path, "/mnt/"): 34 case path == "/mount" || strings.HasPrefix(path, "/mount/"): 35 case path == "/media" || strings.HasPrefix(path, "/media/"): 36 case path == "/sys" || strings.HasPrefix(path, "/sys/"): 37 case path == "/dev" || strings.HasPrefix(path, "/dev/"): 38 default: 39 return false 40 } 41 42 return true 43 }