5 ms·
What prevents a Sandbox mode program from just using a chain of `··`s to access the root?
by Majora320 9y ago
What prevents a Sandbox mode program from just using a chain of `··`s to access the root?
- ithkuil 9y agoIIRC openat(2) honours the sandboxing rules
- loeg 9y agoAccess to ".." above the "root" of a given dirfd are disallowed in the sandbox. So for example, if you have an open dirfd with the LOOKUP capability when you enter the sandbox, you can access the following relative paths: ".", "./foo/bar", "./foo/.." But you cannot access these relative paths: "..", "./foo/../..", etc.