add some sandboxing code

1 files changed, 37 insertions, 0 deletions

diff --git a/snag/src/landlock_signatures.h b/snag/src/landlock_signatures.h
new file mode 100644
index 0000000..0d30608
--- /dev/null
+++ b/snag/src/landlock_signatures.h
@@ -0,0 +1,37 @@
+#ifndef LANDLOCK_SIGS_H
+#define LANDLOCK_SIGS_H
+#include <linux/landlock.h>
+#include <unistd.h>
+#include <sys/syscall.h>
+#include <stdint.h>
+#include <stdlib.h>
+
+#ifndef landlock_create_ruleset
+static inline int
+landlock_create_ruleset(const struct landlock_ruleset_attr *const attr,
+			const size_t size, const uint32_t flags)
+{
+	return syscall(__NR_landlock_create_ruleset, attr, size, flags);
+}
+#endif
+
+#ifndef landlock_add_rule
+static inline int landlock_add_rule(const int ruleset_fd,
+				    const enum landlock_rule_type rule_type,
+				    const void *const rule_attr,
+				    const uint32_t flags)
+{
+	return syscall(__NR_landlock_add_rule, ruleset_fd, rule_type, rule_attr,
+		       flags);
+}
+#endif
+
+#ifndef landlock_restrict_self
+static inline int landlock_restrict_self(const int ruleset_fd,
+					 const uint32_t flags)
+{
+	return syscall(__NR_landlock_restrict_self, ruleset_fd, flags);
+}
+#endif
+
+#endif // LANDLOCK_SIGS_H