Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1724947 > unrolled thread

Re: [PATCH net-next v7 08/10] bpf: Add a Landlock sandbox example

Back to article view | Back to linux.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: [PATCH net-next v7 08/10] bpf: Add a Landlock sandbox example Alban Crequy <alban.crequy@gmail.com> - 2017-09-01 12:30 +0200
    Re: [PATCH net-next v7 08/10] bpf: Add a Landlock sandbox example Mickaël Salaün <mic@digikod.net> - 2017-09-02 15:30 +0200

#1724947 — Re: [PATCH net-next v7 08/10] bpf: Add a Landlock sandbox example

Hi Mickaël,

On 21 August 2017 at 02:09, Mickaël Salaün <mic@digikod.net> wrote:
> Add a basic sandbox tool to create a process isolated from some part of
> the system. This sandbox create a read-only environment. It is only
> allowed to write to a character device such as a TTY:
...
> +       /*
> +        * This check allows the action on the file if it is a directory or a
> +        * pipe. Otherwise, a message is printed to the eBPF log.
> +        */
> +       if (S_ISCHR(ret) || S_ISFIFO(ret))
> +               return 0;


The comment says "directory", but the code checks for "character device".

Thanks!
Alban

[toc] | [next] | [standalone]

#1725506

[Multipart message — attachments visible in raw view] — view raw

On 01/09/2017 12:25, Alban Crequy wrote:
> Hi Mickaël,
> 
> On 21 August 2017 at 02:09, Mickaël Salaün <mic@digikod.net> wrote:
>> Add a basic sandbox tool to create a process isolated from some part of
>> the system. This sandbox create a read-only environment. It is only
>> allowed to write to a character device such as a TTY:
> ...
>> +       /*
>> +        * This check allows the action on the file if it is a directory or a
>> +        * pipe. Otherwise, a message is printed to the eBPF log.
>> +        */
>> +       if (S_ISCHR(ret) || S_ISFIFO(ret))
>> +               return 0;
> 
> 
> The comment says "directory", but the code checks for "character device".
> 
> Thanks!
> Alban
> 

Fixed, thanks!

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web