[minijail] document use of NO_NEW_PRIVS
TEST=None
BUG=None
Change-Id: If95c0aea1f9dcc2f1c990678b4e85289afc841cf
Signed-off-by: Elly Jones <ellyjones@chromium.org>
Reviewed-on: https://gerrit.chromium.org/gerrit/28818
Reviewed-by: Jorge Lucangeli Obes <jorgelo@chromium.org>
diff --git a/libminijail.c b/libminijail.c
index 51a5300..cbd31f2 100644
--- a/libminijail.c
+++ b/libminijail.c
@@ -642,8 +642,9 @@
}
/*
- * Set no_new_privs before installing seccomp filter.
- * TODO(jorgelo): document call to PR_SET_NO_NEW_PRIVS.
+ * Set no_new_privs before installing seccomp filter. See
+ * </kernel/seccomp.c> and </kernel/sys.c> in the kernel source tree for
+ * an explanation of the parameters.
*/
if (j->flags.no_new_privs) {
if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0))