diff options
author | 2024-02-10 04:47:11 -0300 | |
---|---|---|
committer | 2024-02-27 22:27:46 -0300 | |
commit | 9cfeb485eb158217e644955bddc42e3bcf42ccbb (patch) | |
tree | f15092bed9d126ea3e651726e7215c8b7ee4c4ae /etc/inc | |
parent | landlock: add _fs prefix to filesystem functions (diff) | |
download | firejail-9cfeb485eb158217e644955bddc42e3bcf42ccbb.tar.gz firejail-9cfeb485eb158217e644955bddc42e3bcf42ccbb.tar.zst firejail-9cfeb485eb158217e644955bddc42e3bcf42ccbb.zip |
landlock: use "landlock.fs." prefix in filesystem commands
Since Landlock ABI v4 it is possible to restrict actions related to the
network and potentially more areas will be added in the future.
So use `landlock.fs.` as the prefix in the current filesystem-related
commands (and later `landlock.net.` for the network-related commands) to
keep them organized and to match what is used in the kernel.
Examples of filesystem and network access flags:
* `LANDLOCK_ACCESS_FS_EXECUTE`: Execute a file.
* `LANDLOCK_ACCESS_FS_READ_DIR`: Open a directory or list its content.
* `LANDLOCK_ACCESS_NET_BIND_TCP`: Bind a TCP socket to a local port.
* `LANDLOCK_ACCESS_NET_CONNECT_TCP`: Connect an active TCP socket to a
remote port.
Relates to #6078.
Diffstat (limited to 'etc/inc')
-rw-r--r-- | etc/inc/landlock-common.inc | 56 |
1 files changed, 28 insertions, 28 deletions
diff --git a/etc/inc/landlock-common.inc b/etc/inc/landlock-common.inc index 694d447b5..e147963a6 100644 --- a/etc/inc/landlock-common.inc +++ b/etc/inc/landlock-common.inc | |||
@@ -2,38 +2,38 @@ | |||
2 | # Persistent customizations should go in a .local file. | 2 | # Persistent customizations should go in a .local file. |
3 | include landlock-common.local | 3 | include landlock-common.local |
4 | 4 | ||
5 | landlock.read / # whole system read | 5 | landlock.fs.read / # whole system read |
6 | landlock.read /proc | 6 | landlock.fs.read /proc |
7 | landlock.makeipc / # sockets etc. | 7 | landlock.fs.makeipc / # sockets etc. |
8 | 8 | ||
9 | # write access | 9 | # write access |
10 | landlock.write ${HOME} | 10 | landlock.fs.write ${HOME} |
11 | landlock.write ${RUNUSER} | 11 | landlock.fs.write ${RUNUSER} |
12 | landlock.write /dev | 12 | landlock.fs.write /dev |
13 | landlock.write /proc | 13 | landlock.fs.write /proc |
14 | landlock.write /run/shm | 14 | landlock.fs.write /run/shm |
15 | landlock.write /tmp | 15 | landlock.fs.write /tmp |
16 | 16 | ||
17 | # exec access | 17 | # exec access |
18 | ## misc | 18 | ## misc |
19 | landlock.execute /opt | 19 | landlock.fs.execute /opt |
20 | landlock.execute /run/firejail # appimage and various firejail features | 20 | landlock.fs.execute /run/firejail # appimage and various firejail features |
21 | ## bin | 21 | ## bin |
22 | landlock.execute /bin | 22 | landlock.fs.execute /bin |
23 | landlock.execute /sbin | 23 | landlock.fs.execute /sbin |
24 | landlock.execute /usr/bin | 24 | landlock.fs.execute /usr/bin |
25 | landlock.execute /usr/sbin | 25 | landlock.fs.execute /usr/sbin |
26 | landlock.execute /usr/games | 26 | landlock.fs.execute /usr/games |
27 | landlock.execute /usr/local/bin | 27 | landlock.fs.execute /usr/local/bin |
28 | landlock.execute /usr/local/sbin | 28 | landlock.fs.execute /usr/local/sbin |
29 | landlock.execute /usr/local/games | 29 | landlock.fs.execute /usr/local/games |
30 | ## lib | 30 | ## lib |
31 | landlock.execute /lib | 31 | landlock.fs.execute /lib |
32 | landlock.execute /lib32 | 32 | landlock.fs.execute /lib32 |
33 | landlock.execute /libx32 | 33 | landlock.fs.execute /libx32 |
34 | landlock.execute /lib64 | 34 | landlock.fs.execute /lib64 |
35 | landlock.execute /usr/lib | 35 | landlock.fs.execute /usr/lib |
36 | landlock.execute /usr/lib32 | 36 | landlock.fs.execute /usr/lib32 |
37 | landlock.execute /usr/libx32 | 37 | landlock.fs.execute /usr/libx32 |
38 | landlock.execute /usr/lib64 | 38 | landlock.fs.execute /usr/lib64 |
39 | landlock.execute /usr/local/lib | 39 | landlock.fs.execute /usr/local/lib |