mirror of
https://github.com/brunopostle/ifcurl.git
synced 2026-07-12 02:08:13 +00:00
execve is actually permitted — it arrives via @default which is included in @system-service. The main service needs it for GitPython's git CLI calls. Blocking execve only in render subprocesses would require per-process seccomp, which is not worth the complexity for this threat model. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| gitattributes | ||
| gitconfig-ifcmerge | ||
| ifcurl-preview.service | ||