d6
/
xz-analysis-mirror
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

xz: Add a comment to Capsicum sandbox setup. 

This comment is repeated in xzdec.c to help remind us why all the
capabilities are removed from stdin in certain situations.
This commit is contained in:
Jia Tan 2023-12-21 16:39:53 +08:00
parent 4e1c695676
commit 710cbc186c
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
src/xz/file_io.c
View File

@ -226,6 +226,7 @@ io_sandbox_enter(int src_fd)
CAP_EVENT, CAP_FCNTL, CAP_LOOKUP, CAP_READ, CAP_SEEK))) CAP_EVENT, CAP_FCNTL, CAP_LOOKUP, CAP_READ, CAP_SEEK)))
goto error; goto error;
// If not reading from stdin, remove all capabilities from it.
if (src_fd != STDIN_FILENO && cap_rights_limit( if (src_fd != STDIN_FILENO && cap_rights_limit(
STDIN_FILENO, cap_rights_clear(&rights))) STDIN_FILENO, cap_rights_clear(&rights)))
goto error; goto error;