RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-26 08:37:45 +00:00
Code Issues Activity Actions

Base: Clarify and extend unveil(2) man page

Browse source
This commit is contained in:
Max Wipfli 2021-06-06 23:29:17 +02:00 • committed by Andreas Kling
parent 573664758a
commit 73084835da
1 changed files with 14 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

20
Base/usr/share/man/man2/unveil.md
View file

@ -32,15 +32,23 @@ include the following characters:
A single `unveil()` call may specify multiple permission characters at once. A single `unveil()` call may specify multiple permission characters at once.
Subsequent `unveil()` calls may take away permissions from the ones allowed Subsequent `unveil()` calls may take away permissions from the ones allowed
earlier for the same file. Note that unveiling a path with any set of earlier for the same file or directory. Note that it remains possible to unveil
permissions does not turn off the regular permission checks: access to a file subdirectories with any permissions.
which the process has unveiled for itself, but has otherwise no appropriate
permissions for, will still be rejected. Unveiling a directory allows the Note that unveiling a path with any set of permissions does not turn off the
process to access any files inside the directory. regular permission checks: access to a file which the process has unveiled for
itself, but has otherwise no appropriate permissions for, will still be rejected.
Unveiling a directory allows the process to access any files inside the
directory.
Calling `unveil()` with both `path` and `permissions` set to null locks the Calling `unveil()` with both `path` and `permissions` set to null locks the
veil; no further `unveil()` calls are allowed after that. veil; no further `unveil()` calls are allowed after that. Although `unveil()`
calls start to take effect the moment they are made, until the veil is locked,
it remains possible to sometimes circumvent the restrictions set by unveiling
files and directories contained inside a restricted directory with different
permissions.
When a process calls `fork()`, the unveil state is copied to the new process.
The veil state is reset after the program successfully performs an `execve()` The veil state is reset after the program successfully performs an `execve()`
call. call.