Hi Micka?l,

On 21 August 2017 at 02:09, Micka?l Sala?n [off-list ref] wrote:

Add a basic sandbox tool to create a process isolated from some part of
the system. This sandbox create a read-only environment. It is only
allowed to write to a character device such as a TTY:

...

+       /*
+        * This check allows the action on the file if it is a directory or a
+        * pipe. Otherwise, a message is printed to the eBPF log.
+        */
+       if (S_ISCHR(ret) || S_ISFIFO(ret))
+               return 0;

The comment says "directory", but the code checks for "character device".

Thanks!
Alban
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html