diff options
Diffstat (limited to 'snag/src')
| -rw-r--r-- | snag/src/build_db.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/snag/src/build_db.c b/snag/src/build_db.c index cb3785d..ad68be5 100644 --- a/snag/src/build_db.c +++ b/snag/src/build_db.c @@ -90,6 +90,12 @@ bool set_child_sandbox(const package_build_t* build) { return false; } path_beneath.allowed_access = + LANDLOCK_ACCESS_FS_READ_FILE | + LANDLOCK_ACCESS_FS_WRITE_FILE; + if (!landlock_add_path_rule(landlock_fd, &ruleset_attr, "/dev/null", &path_beneath)) { + return false; + } + path_beneath.allowed_access = LANDLOCK_ACCESS_FS_EXECUTE | LANDLOCK_ACCESS_FS_READ_FILE | LANDLOCK_ACCESS_FS_READ_DIR; @@ -118,7 +124,7 @@ bool set_child_sandbox(const package_build_t* build) { return false; } // this is just specific to my system - (rjb) - if (!landlock_add_path_rule(landlock_fd, &ruleset_attr, "/opt/gnome/lib64", &path_beneath)) { + if (!landlock_add_path_rule(landlock_fd, &ruleset_attr, "/opt/gnome/", &path_beneath)) { } path_beneath.allowed_access = LANDLOCK_ACCESS_FS_WRITE_FILE | |