This commit is contained in:
Omar Polo 2021-01-27 10:52:11 +00:00
parent 3300cbe06a
commit 909ea500a4
1 changed files with 2 additions and 2 deletions

View File

@ -111,8 +111,8 @@ listener process is the only one that needs internet access and is
sandboxed. When a CGI script needs to be executed, the executor
(outside of the sandbox) sets up a pipe and gives one end to the
listener, while the other is bound to the CGI script standard output.
This way, is still possible to execute CGI scripts without restriction
even in the presence of a sandbox.
This way, is still possible to execute CGI scripts without
restrictions even in the presence of a sandbox.
On OpenBSD, the listener process runs with the `stdio recvfd rpath
inet` pledges and has `unveil(2)`ed only the directories that it