From 79b4c18c9ae2f04989d1f2f0ad0fd4e0582ee508 Mon Sep 17 00:00:00 2001
From: sqwishy <somebody@froghat.ca>
Date: Wed, 31 Aug 2022 12:48:10 -0700
Subject: [PATCH] optional ro mount /etc/pki in nsjail (#519)

contents of /etc/ssl symlink to /etc/pki on my system (Fedora) so some
programs (like pip) fail without /etc/pki
---
 nsjail/download.config.proto    | 7 +++++++
 nsjail/run.deno.config.proto    | 7 +++++++
 nsjail/run.python3.config.proto | 7 +++++++
 3 files changed, 21 insertions(+)

diff --git a/nsjail/download.config.proto b/nsjail/download.config.proto
index 0c27883a99..f2cf7b1383 100644
--- a/nsjail/download.config.proto
+++ b/nsjail/download.config.proto
@@ -50,6 +50,13 @@ mount {
 	is_bind: true
 }
 
+mount {
+    src: "/etc/pki"
+    dst: "/etc/pki"
+    is_bind: true
+    mandatory: false
+}
+
 mount {
     src: "/etc/ca-certificates"
     dst: "/etc/ca-certificates"
diff --git a/nsjail/run.deno.config.proto b/nsjail/run.deno.config.proto
index 4144b4a685..03e9275b89 100644
--- a/nsjail/run.deno.config.proto
+++ b/nsjail/run.deno.config.proto
@@ -85,6 +85,13 @@ mount {
 	is_bind: true
 }
 
+mount {
+    src: "/etc/pki"
+    dst: "/etc/pki"
+    is_bind: true
+    mandatory: false
+}
+
 mount {
     src: "/etc/resolv.conf"
     dst: "/etc/resolv.conf"
diff --git a/nsjail/run.python3.config.proto b/nsjail/run.python3.config.proto
index 1f27c4e7aa..524e3a9bf0 100644
--- a/nsjail/run.python3.config.proto
+++ b/nsjail/run.python3.config.proto
@@ -96,6 +96,13 @@ mount {
 	is_bind: true
 }
 
+mount {
+    src: "/etc/pki"
+    dst: "/etc/pki"
+    is_bind: true
+    mandatory: false
+}
+
 mount {
     src: "/etc/resolv.conf"
     dst: "/etc/resolv.conf"