1 files changed, 28 insertions, 0 deletions

diff --git a/src/firejail/main.c b/src/firejail/main.c
index 0327f8bda..5bcc3a0e5 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -75,6 +75,9 @@ int arg_overlay = 0;				// overlay option
 int arg_overlay_keep = 0;                       // place overlay diff in a known directory
 int arg_overlay_reuse = 0;                      // allow the reuse of overlays
 
+int arg_landlock = 0;                   // add basic Landlock rules
+int arg_landlock_proc = 2;              // 0 - no access; 1 -read-only; 2 - read-write
+
 int arg_seccomp = 0;                            // enable default seccomp filter
 int arg_seccomp32 = 0;                          // enable default seccomp filter for 32 bit arch
 int arg_seccomp_postexec = 0;                   // need postexec ld.preload library?
@@ -1500,6 +1503,31 @@ int main(int argc, char **argv, char **envp) {
                         else
                                 exit_err_feature("seccomp");
                 }
+#ifdef HAVE_LANDLOCK
+                else if (strcmp(argv[i], "--landlock") == 0)
+                        arg_landlock = 1;
+                else if (strncmp(argv[i], "--landlock.proc=", 16) == 0) {
+                        if (strncmp(argv[i] + 16, "no", 2) == 0)
+                                arg_landlock_proc = 0;
+                        else if (strncmp(argv[i] + 16, "ro", 2) == 0)
+                                arg_landlock_proc = 1;
+                        else if (strncmp(argv[i] + 16, "rw", 2) == 0)
+                                arg_landlock_proc = 2;
+                        else {
+                                fprintf(stderr, "Error: invalid landlock.proc value: %s\n",
+                                        argv[i] + 16);
+                                exit(1);
+                        }
+                }
+                else if (strncmp(argv[i], "--landlock.read=", 16) == 0)
+                        ll_add_profile(LL_READ, argv[i] + 16);
+                else if (strncmp(argv[i], "--landlock.write=", 17) == 0)
+                        ll_add_profile(LL_WRITE, argv[i] + 17);
+                else if (strncmp(argv[i], "--landlock.special=", 19) == 0)
+                        ll_add_profile(LL_SPECIAL, argv[i] + 19);
+                else if (strncmp(argv[i], "--landlock.execute=", 19) == 0)
+                        ll_add_profile(LL_EXEC, argv[i] + 19);
+#endif
                 else if (strcmp(argv[i], "--memory-deny-write-execute") == 0) {
                         if (checkcfg(CFG_SECCOMP))
                                 arg_memory_deny_write_execute = 1;