Mark init process as dumpable so we can see stuff in its /proc

Now that we're properly getting rid of root in these we can mark it
dumpable, which enables use of some /proc files, like /proc/$pid/root that
was previously not accessible for pid1 in the sandbox.

1 files changed, 4 insertions, 0 deletions

diff --git a/bubblewrap.c b/bubblewrap.c
index 645a3cf..027f8c9 100644
--- a/bubblewrap.c
+++ b/bubblewrap.c
@@ -826,6 +826,10 @@ drop_privs (bool keep_requested_caps)
     die_with_error ("unable to drop root uid");
 
   drop_all_caps (keep_requested_caps);
+
+  /* We don't have any privs now, so mark us dumpable which makes /proc/self be owned by the user instead of root */
+  if (prctl (PR_SET_DUMPABLE, 1, 0, 0, 0) != 0)
+    die_with_error ("can't set dumpable");
 }
 
 static char *