From 760f50f78ad13664d7a32b4577381c0341ab2d4a Mon Sep 17 00:00:00 2001 From: "Kelvin M. Klann" Date: Fri, 17 Nov 2023 19:57:29 -0300 Subject: landlock: move commands into profile and add landlock.enforce Changes: * Move commands from --landlock and --landlock.proc= into etc/inc/landlock-common.inc * Remove --landlock and --landlock.proc= * Add --landlock.enforce Instead of hard-coding the default commands (and having a separate command just for /proc), move them into a dedicated profile to make it easier for users to interact with the entries (view, copy, add ignore entries, etc). Only enforce the Landlock commands if --landlock.enforce is supplied. This allows safely adding Landlock commands to (upstream) profiles while keeping their enforcement opt-in. It also makes it simpler to effectively disable all Landlock commands, by using `--ignore=landlock.enforce`. Relates to #6078. --- src/bash_completion/firejail.bash_completion.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'src/bash_completion/firejail.bash_completion.in') diff --git a/src/bash_completion/firejail.bash_completion.in b/src/bash_completion/firejail.bash_completion.in index eab0f7df6..76667ca0c 100644 --- a/src/bash_completion/firejail.bash_completion.in +++ b/src/bash_completion/firejail.bash_completion.in @@ -42,7 +42,7 @@ _firejail() _filedir -d return 0 ;; - --landlock) + --landlock.enforce) return 0 ;; --landlock.read) -- cgit v1.2.3-54-g00ecf