-
Notifications
You must be signed in to change notification settings - Fork 556
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Write to console error message when trying to rename a whitelisted file. #2874
Comments
Why not add this into |
I would say let's try it out. We are already doing something similar to LD_PRELOAD for --trace and --tracelog. Also seccomp ends up there in some cases. It's not a pure LD_PRELOAD, more like a global one based on /etc/ld.preload file. So we generate a new /etc/ld.preload file and we place in it some of our libraries (src/libtrace, src/libtracelog, src/libpostexec). When the sandboxed program starts, it will load the .so libraries. The code to build the new /etc/ld.preload is in fs_trace,c. |
Since the issue where rename fails on whitelisted files is somewhat common. I suggest that we try to actively notify the user when this issue is triggered. I think we can actively enable this notification only for selected profiles by adding a config option (eg.
notify-rename-whitelist
).For such profiles, we could hook
rename
withLD_PRELOAD
library. When arename
fails withEBUSY
, check that the file is a mountpoint, and then write to the console a glaring message saying something to the effect that this is a known issue and to go to a url in our wiki explaining the issue and potential work arounds.For extra points, we could detect that a program is a graphical one and also popup the message in a popup box (using our own custom program or something like xmessage, but prettier, on the host system).
Using
LD_PRELOAD
won't work for programs that bypass glibc for syscalls, but I'd expect that to be a rare situation.See #2071, #1355, #1793 for some reference on this issue.
The text was updated successfully, but these errors were encountered: