> Filesystem denial traces identify the policy change needed to allow a > request, so require exact blocker values rather than merely nonempty > output. Pin a READ_DIR denial to exactly one event with > blockers=read_dir. Pin a REFER-only mount denial to EPERM and exactly > one event with blockers=change_topology. > > The mount child retains CAP_SYS_ADMIN so Landlock is the only expected > source of EPERM. This prevents a later capability failure from masking > a Landlock regression; the trace-collecting parent remains unsandboxed. > > Cc: Günther Noack <[email protected]> > Cc: Steven Rostedt <[email protected]> > Signed-off-by: Mickaël Salaün <[email protected]>
Sashiko has reviewed this patch and found no issues. It looks great! -- Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=7
