On 07/20 09:36, Nicholas Marriott wrote: > Hi > > I'm not sure I can think of many uses for this, tame is not something > you are intended to just apply blindly, do you have any use cases?
Well, there is the example in the man page. :) But no, currently it's not very useful, as more complex programs such as sh(1) or perl(1) won't start even if given all current tame(2) permissions. For this to be useful, you'd need to give TAME_EXEC additional permissions such that you could do `tame -tp sh`, and get a sh that could execute processes, but not write to the file system or do network access. And like I said originally, I'm not sure this is a good idea. It was just a way for me to get more kernel experience. > I think the -aCcdghIiRSptuw approach is a bad idea and it would be > better to do it with named flags like -o abort,cmsg,cpath. Maybe take a > look at getsubopt(3), although I don't know if that API is in vogue > anymore. If this is worthy of more work, the command line options can certainly be changed. I just used getopt(3) since it seemed like the easiest way to handle it. > Also adding TAME_EXEC seems like a different change entirely? Without TAME_EXEC, you can't call execve(2) to create another process. There currently isn't a tame(2) permission that allows execing, one had to be added. Thanks, Jeremy
