Hi Mickaël,
On 21 August 2017 at 02:09, Mickaël Salaün [off-list ref] wrote:
Add a basic sandbox tool to create a process isolated from some part of
the system. This sandbox create a read-only environment. It is only
allowed to write to a character device such as a TTY:
...
quoted hunk ↗ jump to hunk
+ /*
+ * This check allows the action on the file if it is a directory or a
+ * pipe. Otherwise, a message is printed to the eBPF log.
+ */
+ if (S_ISCHR(ret) || S_ISFIFO(ret))
+ return 0;
The comment says "directory", but the code checks for "character device".
Thanks!
Alban