Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751923AbdIAKZv (ORCPT ); Fri, 1 Sep 2017 06:25:51 -0400 Received: from mail-io0-f195.google.com ([209.85.223.195]:34653 "EHLO mail-io0-f195.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751670AbdIAKZp (ORCPT ); Fri, 1 Sep 2017 06:25:45 -0400 X-Google-Smtp-Source: ADKCNb5zN8gYBGOtJLs+nWZvFuIADrNoj+mo29MLrNqjYbB9iO5xk6xC5ES8n6ji2MkVa54zrqIRprBNlzJQY2uTIMg= MIME-Version: 1.0 In-Reply-To: <20170821000933.13024-9-mic@digikod.net> References: <20170821000933.13024-1-mic@digikod.net> <20170821000933.13024-9-mic@digikod.net> From: Alban Crequy Date: Fri, 1 Sep 2017 12:25:24 +0200 X-Google-Sender-Auth: gHWxVKh7rryLC2bkR5C5E8fl0G8 Message-ID: Subject: Re: [PATCH net-next v7 08/10] bpf: Add a Landlock sandbox example To: =?UTF-8?B?TWlja2HDq2wgU2FsYcO8bg==?= Cc: "linux-kernel@vger.kernel.org" , Alexei Starovoitov , Andy Lutomirski , Arnaldo Carvalho de Melo , Casey Schaufler , Daniel Borkmann , David Drysdale , "David S . Miller" , "Eric W . Biederman" , James Morris , Jann Horn , Jonathan Corbet , Matthew Garrett , Michael Kerrisk , Kees Cook , Paul Moore , Sargun Dhillon , "Serge E . Hallyn" , Shuah Khan , Tejun Heo , Thomas Graf , Will Drewry , kernel-hardening@lists.openwall.com, Linux API , LSM , netdev@vger.kernel.org, Michael Schubert , Iago Lopez Galeiras , Alban Crequy Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by nfs id v81APthH008143 Content-Length: 627 Lines: 19 Hi Mickaël, On 21 August 2017 at 02:09, Mickaël Salaün wrote: > Add a basic sandbox tool to create a process isolated from some part of > the system. This sandbox create a read-only environment. It is only > allowed to write to a character device such as a TTY: ... > + /* > + * This check allows the action on the file if it is a directory or a > + * pipe. Otherwise, a message is printed to the eBPF log. > + */ > + if (S_ISCHR(ret) || S_ISFIFO(ret)) > + return 0; The comment says "directory", but the code checks for "character device". Thanks! Alban