packaged xdemineur (and added desc dir to api (and fiddled with snadboxing))

1 files changed, 9 insertions, 2 deletions

diff --git a/snag/src/build_db.c b/snag/src/build_db.c
index ad68be5..06099f6 100644
--- a/snag/src/build_db.c
+++ b/snag/src/build_db.c
@@ -86,7 +86,7 @@ bool set_child_sandbox(const package_build_t* build) {
     if (!landlock_add_path_rule(landlock_fd, &ruleset_attr, cfg.build_package_script, &path_beneath)) {
         return false;
     }
-    if (!landlock_add_path_rule(landlock_fd, &ruleset_attr, build->package->script_path, &path_beneath)) {
+    if (!landlock_add_path_rule(landlock_fd, &ruleset_attr, build->package->desc_dir, &path_beneath)) {
         return false;
     }
     path_beneath.allowed_access =
@@ -139,7 +139,8 @@ bool set_child_sandbox(const package_build_t* build) {
             LANDLOCK_ACCESS_FS_MAKE_FIFO |
             LANDLOCK_ACCESS_FS_MAKE_BLOCK |
             LANDLOCK_ACCESS_FS_MAKE_SYM |
-            LANDLOCK_ACCESS_FS_TRUNCATE;
+            LANDLOCK_ACCESS_FS_TRUNCATE |
+            LANDLOCK_ACCESS_FS_EXECUTE;
     if (!landlock_add_path_rule(landlock_fd, &ruleset_attr, "/tmp", &path_beneath)) {
         return false;
     }
@@ -281,6 +282,12 @@ void build_run(const package_build_t* build) {
                     write(api_to_sh[1], tmp, strlen(tmp));
                     free(tmp);
                 }
+                if (strncmp(buf, "descdir", sizeof("descdir") - 1) == 0) {
+                    char* tmp = vastrcat(build->package->desc_dir, "\n");
+                    write(api_to_sh[1], tmp, strlen(tmp));
+                    free(tmp);
+                }
+                // failure, failed to work (asked for bad var)
                 break;
             case API_MESSAGE_NONE:
 				break;