diff options
Diffstat (limited to 'src/firejail/landlock.c')
-rw-r--r-- | src/firejail/landlock.c | 50 |
1 files changed, 0 insertions, 50 deletions
diff --git a/src/firejail/landlock.c b/src/firejail/landlock.c index e93bde402..11de2e297 100644 --- a/src/firejail/landlock.c +++ b/src/firejail/landlock.c | |||
@@ -202,56 +202,6 @@ int ll_exec(const char *allowed_path) { | |||
202 | return ll_fs(allowed_path, allowed_access, __func__); | 202 | return ll_fs(allowed_path, allowed_access, __func__); |
203 | } | 203 | } |
204 | 204 | ||
205 | int ll_basic_system(void) { | ||
206 | if (!ll_is_supported()) | ||
207 | return 0; | ||
208 | |||
209 | if (ll_ruleset_fd == -1) | ||
210 | ll_ruleset_fd = ll_create_full_ruleset(); | ||
211 | |||
212 | int error = | ||
213 | ll_read("/") || // whole system read | ||
214 | ll_special("/") || // sockets etc. | ||
215 | |||
216 | // write access | ||
217 | ll_write("${HOME}") || | ||
218 | ll_write("${RUNUSER}") || | ||
219 | ll_write("/dev") || | ||
220 | ll_write("/run/shm") || | ||
221 | ll_write("/tmp") || | ||
222 | |||
223 | // exec access | ||
224 | /// misc | ||
225 | ll_exec("/opt") || | ||
226 | ll_exec("/run/firejail") || // appimage and various firejail features | ||
227 | /// bin | ||
228 | ll_exec("/bin") || | ||
229 | ll_exec("/sbin") || | ||
230 | ll_exec("/usr/bin") || | ||
231 | ll_exec("/usr/sbin") || | ||
232 | ll_exec("/usr/games") || | ||
233 | ll_exec("/usr/local/bin") || | ||
234 | ll_exec("/usr/local/sbin") || | ||
235 | ll_exec("/usr/local/games") || | ||
236 | /// lib | ||
237 | ll_exec("/lib") || | ||
238 | ll_exec("/lib32") || | ||
239 | ll_exec("/libx32") || | ||
240 | ll_exec("/lib64") || | ||
241 | ll_exec("/usr/lib") || | ||
242 | ll_exec("/usr/lib32") || | ||
243 | ll_exec("/usr/libx32") || | ||
244 | ll_exec("/usr/lib64") || | ||
245 | ll_exec("/usr/local/lib"); | ||
246 | |||
247 | if (error) { | ||
248 | fprintf(stderr, "Error: %s: failed to set --landlock rules\n", | ||
249 | __func__); | ||
250 | } | ||
251 | |||
252 | return error; | ||
253 | } | ||
254 | |||
255 | int ll_restrict(uint32_t flags) { | 205 | int ll_restrict(uint32_t flags) { |
256 | if (!ll_is_supported()) | 206 | if (!ll_is_supported()) |
257 | return 0; | 207 | return 0; |