3 ms·
Can't you openat(fd,"..")? I don't think this is a sufficient sandbox.
by singron 5y ago
Can't you openat(fd,"..")? I don't think this is a sufficient sandbox.
- floatboth 5y agoNo, not in a capability-based environment. Once you cap_enter() on FreeBSD, you can't – that's the whole point. Same in proper WASI runtime implementations. Please don't assume people are stupid ;) These sandboxes have been carefully designed and extensively tested.
- justincormack 5y agoopenat2 now has RESOLVE_BENEATH to fix that.