diff options
| author | Rodrigo Vivi <rodrigo.vivi@intel.com> | 2024-04-02 08:17:13 -0400 |
|---|---|---|
| committer | Rodrigo Vivi <rodrigo.vivi@intel.com> | 2024-04-02 08:17:13 -0400 |
| commit | 5add703f6acad1c63f8a532b6de56e50d548e904 (patch) | |
| tree | be39a82716119cd8b7cf7e2734baf8cd9a80ceb7 /samples/landlock/sandboxer.c | |
| parent | 71cdfa8cad300caa7afcbba09776bbc8dcfa9e39 (diff) | |
| parent | 39cd87c4eb2b893354f3b850f916353f2658ae6f (diff) | |
Merge drm/drm-next into drm-intel-next
Catching up on 6.9-rc2
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Diffstat (limited to 'samples/landlock/sandboxer.c')
| -rw-r--r-- | samples/landlock/sandboxer.c | 13 |
1 files changed, 8 insertions, 5 deletions
diff --git a/samples/landlock/sandboxer.c b/samples/landlock/sandboxer.c index 08596c0ef070..32e930c853bb 100644 --- a/samples/landlock/sandboxer.c +++ b/samples/landlock/sandboxer.c @@ -1,7 +1,7 @@ // SPDX-License-Identifier: BSD-3-Clause /* - * Simple Landlock sandbox manager able to launch a process restricted by a - * user-defined filesystem access control policy. + * Simple Landlock sandbox manager able to execute a process restricted by + * user-defined file system and network access control policies. * * Copyright © 2017-2020 Mickaël Salaün <mic@digikod.net> * Copyright © 2020 ANSSI @@ -120,9 +120,11 @@ static int populate_ruleset_fs(const char *const env_var, const int ruleset_fd, if (path_beneath.parent_fd < 0) { fprintf(stderr, "Failed to open \"%s\": %s\n", path_list[i], strerror(errno)); - goto out_free_name; + continue; } if (fstat(path_beneath.parent_fd, &statbuf)) { + fprintf(stderr, "Failed to stat \"%s\": %s\n", + path_list[i], strerror(errno)); close(path_beneath.parent_fd); goto out_free_name; } @@ -227,7 +229,7 @@ int main(const int argc, char *const argv[], char *const *const envp) ENV_FS_RO_NAME, ENV_FS_RW_NAME, ENV_TCP_BIND_NAME, ENV_TCP_CONNECT_NAME, argv[0]); fprintf(stderr, - "Launch a command in a restricted environment.\n\n"); + "Execute a command in a restricted environment.\n\n"); fprintf(stderr, "Environment variables containing paths and ports " "each separated by a colon:\n"); @@ -248,7 +250,7 @@ int main(const int argc, char *const argv[], char *const *const envp) ENV_TCP_CONNECT_NAME); fprintf(stderr, "\nexample:\n" - "%s=\"/bin:/lib:/usr:/proc:/etc:/dev/urandom\" " + "%s=\"${PATH}:/lib:/usr:/proc:/etc:/dev/urandom\" " "%s=\"/dev/null:/dev/full:/dev/zero:/dev/pts:/tmp\" " "%s=\"9418\" " "%s=\"80:443\" " @@ -383,6 +385,7 @@ int main(const int argc, char *const argv[], char *const *const envp) cmd_path = argv[1]; cmd_argv = argv + 1; + fprintf(stderr, "Executing the sandboxed command...\n"); execvpe(cmd_path, cmd_argv, envp); fprintf(stderr, "Failed to execute \"%s\": %s\n", cmd_path, strerror(errno)); |