Merge pull request #6078 from kmk3/landlock_v3

feature: add Landlock support

1 files changed, 22 insertions, 0 deletions

diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 827be5d85..dbc115137 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -516,6 +516,28 @@ void start_application(int no_sandbox, int fd, char *set_sandbox_status) {
                 printf("LD_PRELOAD=%s\n", getenv("LD_PRELOAD"));
         }
 
+#ifdef HAVE_LANDLOCK
+        //****************************
+        // Configure Landlock
+        //****************************
+        if (arg_landlock)
+                ll_basic_system();
+
+        if (ll_get_fd() != -1) {
+                if (arg_landlock_proc >= 1)
+                        ll_read("/proc/");
+                if (arg_landlock_proc == 2)
+                        ll_write("/proc/");
+        }
+
+        if (ll_restrict(0)) {
+                // It isn't safe to continue if Landlock self-restriction was
+                // enabled and the "landlock_restrict_self" syscall has failed.
+                fprintf(stderr, "Error: ll_restrict() failed, exiting...\n");
+                exit(1);
+        }
+#endif
+
         if (just_run_the_shell) {
                 char *arg[2];
                 arg[0] = cfg.usershell;