diff options
author | 2022-08-29 08:44:41 -0400 | |
---|---|---|
committer | 2022-08-29 08:44:41 -0400 | |
commit | 54cb3e741e972c754e595d56de0bca0792299f83 (patch) | |
tree | 60ec6ead9fa5931c350b6a8724bf3c08c443929f /src/man/firejail-profile.txt | |
parent | merges, fixed lbry-viewer as suggested (diff) | |
parent | tinyLL has been removed as it's no longer needed (diff) | |
download | firejail-54cb3e741e972c754e595d56de0bca0792299f83.tar.gz firejail-54cb3e741e972c754e595d56de0bca0792299f83.tar.zst firejail-54cb3e741e972c754e595d56de0bca0792299f83.zip |
Merge pull request #5315 from ChrysoliteAzalea/landlock
Add Landlock support to Firejail
Diffstat (limited to 'src/man/firejail-profile.txt')
-rw-r--r-- | src/man/firejail-profile.txt | 29 |
1 files changed, 29 insertions, 0 deletions
diff --git a/src/man/firejail-profile.txt b/src/man/firejail-profile.txt index 138aae8af..1f543980e 100644 --- a/src/man/firejail-profile.txt +++ b/src/man/firejail-profile.txt | |||
@@ -497,6 +497,35 @@ Blacklist all Linux capabilities. | |||
497 | .TP | 497 | .TP |
498 | \fBcaps.keep capability,capability,capability | 498 | \fBcaps.keep capability,capability,capability |
499 | Whitelist given Linux capabilities. | 499 | Whitelist given Linux capabilities. |
500 | #ifdef HAVE_LANDLOCK | ||
501 | .TP | ||
502 | \fBlandlock | ||
503 | Create a Landlock ruleset (if it doesn't already exist) and add basic access rules to it. | ||
504 | .br | ||
505 | .TP | ||
506 | \fBlandlock.proc no|ro|rw | ||
507 | Add an access rule for /proc directory (read-only if set to \fBro\fR and read-write if set to \fBrw\fR). The access rule for /proc is added after this directory is set up in the sandbox. Access rules for /proc set up with other Landlock-related profile options have no effect. | ||
508 | .br | ||
509 | .TP | ||
510 | \fBlandlock.read path | ||
511 | Create a Landlock ruleset (if it doesn't already exist) and add a read access rule for path. | ||
512 | .br | ||
513 | |||
514 | .TP | ||
515 | \fBlandlock.write path | ||
516 | Create a Landlock ruleset (if it doesn't already exist) and add a write access rule for path. | ||
517 | .br | ||
518 | |||
519 | .TP | ||
520 | \fBlandlock.special path | ||
521 | Create a Landlock ruleset (if it doesn't already exist) and add an access rule for creation of FIFO pipes, Unix-domain sockets and block devices beneath given path. | ||
522 | .br | ||
523 | |||
524 | .TP | ||
525 | \fBlandlock.execute path | ||
526 | Create a Landlock ruleset (if it doesn't already exist) and add an execution permission rule for path. | ||
527 | .br | ||
528 | #endif | ||
500 | .TP | 529 | .TP |
501 | \fBmemory-deny-write-execute | 530 | \fBmemory-deny-write-execute |
502 | Install a seccomp filter to block attempts to create memory mappings | 531 | Install a seccomp filter to block attempts to create memory mappings |