Kernel+Userland: Add a prctl option to enter jail mode until a call to the execve syscall
#24926
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
github-actions
bot
added
the
👀 pr-needs-review
timschumi
reviewed
Sep 1, 2024
In all instances, it should be clear that the jailing of a process is ending when the process exits. This is a preparation before introducing another option to set a process as jailed until it calls the execve syscall.
In addition to the already existing option to enter jail mode (which is set indefinitely), there should be a less restrictive option that should allow exiting jail mode when doing the execve syscall. This option will be useful for programs that need this kind of security layer only in their runtime, but they're meant to actually initiate another program in the end.
This will be used later on, within the Assistant program.
Otherwise, programs will inherit the jailing property which might lead to undesired behavior (such as `Terminal` running jailed `Shell`, for example).
supercomputer7
force-pushed
the
add-jail-mode-until-exec
branch
from
02764ea
to
2ab2648
Compare
timschumi
requested changes
Sep 9, 2024
Comment on lines
63
to
+64
|
|
||
| When the user process is jailed, it can't create or attach to other resources. | ||
| When the user process is jailed **until exit**, it can't create or attach to other resources. |
There was a problem hiding this comment.
Should be in the previous commit.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Resolves #24913.