> Filesystem denial traces identify the policy change needed to allow a
> request, so require exact blocker values rather than merely nonempty
> output. Pin a READ_DIR denial to exactly one event with
> blockers=read_dir. Pin a REFER-only mount denial to EPERM and exactly
> one event with blockers=change_topology.
> 
> The mount child retains CAP_SYS_ADMIN so Landlock is the only expected
> source of EPERM.  This prevents a later capability failure from masking
> a Landlock regression; the trace-collecting parent remains unsandboxed.
> 
> Cc: Günther Noack <[email protected]>
> Cc: Steven Rostedt <[email protected]>
> Signed-off-by: Mickaël Salaün <[email protected]>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · 
https://sashiko.dev/#/patchset/[email protected]?part=7


Reply via email to