]> www.infradead.org Git - users/jedix/linux-maple.git/commit
samples/landlock: Add support for signal scoping
authorTahera Fahimi <fahimitahera@gmail.com>
Fri, 6 Sep 2024 21:30:07 +0000 (15:30 -0600)
committerMickaël Salaün <mic@digikod.net>
Mon, 16 Sep 2024 21:50:54 +0000 (23:50 +0200)
commitf490e205bcbada6eb6dca8b75a2511685e6bd0f0
treecfd4fb6c27ed45675d60de9e2b84e663b4fd53a6
parentf34e9ce5f4794387121120b2d2ff5aa265ef6ce9
samples/landlock: Add support for signal scoping

The sandboxer can receive the character "s" as input from the
environment variable LL_SCOPE to restrict sandboxed processes from
sending signals to processes outside of the sandbox.

Example
=======

Create a sandboxed shell and pass the character "s" to LL_SCOPED:
  LL_FS_RO=/ LL_FS_RW=. LL_SCOPED="s" ./sandboxer /bin/bash

Try to send a SIGTRAP to a process with process ID <PID> through:
  kill -SIGTRAP <PID>

The sandboxed process should not be able to send the signal.

Signed-off-by: Tahera Fahimi <fahimitahera@gmail.com>
Link: https://lore.kernel.org/r/1f3f1992b2abeb8e5d7aa61b854e1b0721978b9a.1725657728.git.fahimitahera@gmail.com
[mic: Improve commit message, simplify code, rebase on previous sample
change]
Signed-off-by: Mickaël Salaün <mic@digikod.net>
samples/landlock/sandboxer.c