comment update

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

diff --git a/src/sys_quotactl.rs b/src/sys_quotactl.rs
index 2b0032ca27df400a898fbde548140b28c95caa0c..ed33878124e58a3d3324aaa9054c0303bdc09b11 100644 (file)
--- a/src/sys_quotactl.rs
+++ b/src/sys_quotactl.rs
@@ -63,10 +63,12 @@ pub async fn quotactl(msg: &ProxyMessageBuffer) -> Result<SyscallStatus, Error>
     // let _id = msg.arg_int(2)?;
     // let _addr = msg.arg_caddr_t(3)?;
 
-    // FIXME: We can *generally* check that `special` if not None points to a block device owned
+    // XXX: We can *generally* check that `special` if not None points to a block device owned
     // by the container. On the other hand, the container should not have access to the device
     // anyway unless the `devices` cgroup allows it, and should not have been allowed to `mknod` a
     // device on a non-NODEV mounted file system.
+    // Further, we do join the container's devices cgroup, so even if the device node makes its way
+    // into the container, the cgroup should cover this?
 
     let kind = cmd & KINDMASK;
     let subcmd = ((cmd as c_uint) >> SUBCMDSHIFT) as c_int;