mirror of
https://git.tukaani.org/xz.git
synced 2024-04-04 12:36:23 +02:00
xz: Add a comment to Capsicum sandbox setup.
This comment is repeated in xzdec.c to help remind us why all the capabilities are removed from stdin in certain situations.
This commit is contained in:
parent
4e1c695676
commit
710cbc186c
1 changed files with 1 additions and 0 deletions
|
@ -226,6 +226,7 @@ io_sandbox_enter(int src_fd)
|
|||
CAP_EVENT, CAP_FCNTL, CAP_LOOKUP, CAP_READ, CAP_SEEK)))
|
||||
goto error;
|
||||
|
||||
// If not reading from stdin, remove all capabilities from it.
|
||||
if (src_fd != STDIN_FILENO && cap_rights_limit(
|
||||
STDIN_FILENO, cap_rights_clear(&rights)))
|
||||
goto error;
|
||||
|
|
Loading…
Reference in a new issue