aboutsummaryrefslogtreecommitdiffstats
path: root/src/firejail/landlock.c
diff options
context:
space:
mode:
Diffstat (limited to 'src/firejail/landlock.c')
-rw-r--r--src/firejail/landlock.c50
1 files changed, 0 insertions, 50 deletions
diff --git a/src/firejail/landlock.c b/src/firejail/landlock.c
index e93bde402..11de2e297 100644
--- a/src/firejail/landlock.c
+++ b/src/firejail/landlock.c
@@ -202,56 +202,6 @@ int ll_exec(const char *allowed_path) {
202 return ll_fs(allowed_path, allowed_access, __func__); 202 return ll_fs(allowed_path, allowed_access, __func__);
203} 203}
204 204
205int ll_basic_system(void) {
206 if (!ll_is_supported())
207 return 0;
208
209 if (ll_ruleset_fd == -1)
210 ll_ruleset_fd = ll_create_full_ruleset();
211
212 int error =
213 ll_read("/") || // whole system read
214 ll_special("/") || // sockets etc.
215
216 // write access
217 ll_write("${HOME}") ||
218 ll_write("${RUNUSER}") ||
219 ll_write("/dev") ||
220 ll_write("/run/shm") ||
221 ll_write("/tmp") ||
222
223 // exec access
224 /// misc
225 ll_exec("/opt") ||
226 ll_exec("/run/firejail") || // appimage and various firejail features
227 /// bin
228 ll_exec("/bin") ||
229 ll_exec("/sbin") ||
230 ll_exec("/usr/bin") ||
231 ll_exec("/usr/sbin") ||
232 ll_exec("/usr/games") ||
233 ll_exec("/usr/local/bin") ||
234 ll_exec("/usr/local/sbin") ||
235 ll_exec("/usr/local/games") ||
236 /// lib
237 ll_exec("/lib") ||
238 ll_exec("/lib32") ||
239 ll_exec("/libx32") ||
240 ll_exec("/lib64") ||
241 ll_exec("/usr/lib") ||
242 ll_exec("/usr/lib32") ||
243 ll_exec("/usr/libx32") ||
244 ll_exec("/usr/lib64") ||
245 ll_exec("/usr/local/lib");
246
247 if (error) {
248 fprintf(stderr, "Error: %s: failed to set --landlock rules\n",
249 __func__);
250 }
251
252 return error;
253}
254
255int ll_restrict(uint32_t flags) { 205int ll_restrict(uint32_t flags) {
256 if (!ll_is_supported()) 206 if (!ll_is_supported())
257 return 0; 207 return 0;