Kelvin M. Klann f70ffbe76c landlock: split .special into .makeipc and .makedev ... As discussed with @topimiettinen[1], it is unlikely that an unprivileged process would need to directly create block or character devices. Also, `landlock.special` is not very descriptive of what it allows. So split `landlock.special` into: * `landlock.makeipc`: allow creating named pipes and sockets (which are usually used for inter-process communication) * `landlock.makedev`: allow creating block and character devices Misc: The `makedev` name is based on `nodev` from mount(8), which makes mount not interpret block and character devices. `ipc` was suggested by @rusty-snake[2]. Relates to #6078. [1] https://github.com/netblue30/firejail/pull/6078#pullrequestreview-1740569786 [2] https://github.com/netblue30/firejail/pull/6187#issuecomment-1924107294		2024-02-02 19:37:06 -03:00
..
profile.template	landlock: split .special into .makeipc and .makedev	2024-02-02 19:37:06 -03:00
redirect_alias-profile.template	Update wording in templates (#2815)	2019-06-30 20:51:17 +00:00
syscalls.txt	Fix wrong syscall names for s390_pci_mmio_{read,write}	2023-08-26 21:48:44 +03:00