add some sandboxing code

1 files changed, 15 insertions, 0 deletions

diff --git a/snag/src/sandboxing.h b/snag/src/sandboxing.h
new file mode 100644
index 0000000..4b7adfc
--- /dev/null
+++ b/snag/src/sandboxing.h
@@ -0,0 +1,15 @@
+#ifndef SANDBOXING_H
+#define SANDBOXING_H
+#include <stdlib.h>
+#include <linux/landlock.h>
+
+// returns -1 for error
+int create_new_landlock_ruleset(struct landlock_ruleset_attr* ruleset_attr);
+
+// returns false for error
+bool landlock_add_path_rule(int landlock_fd, const struct landlock_ruleset_attr* ruleset_attr, const char* path, struct landlock_path_beneath_attr* path_beneath);
+// closes landlock_fd
+// returns false for error
+bool landlock_enforce(int landlock_fd);
+
+#endif // SANDBOXING_H