From c404df1214d9989e79a78c0313b588468cead4e2 Mon Sep 17 00:00:00 2001
From: Riley Beckett <rbeckettvt@gmail.com>
Date: Tue, 28 Jul 2026 22:43:42 -0400
Subject: fix landlock as it wasn't working

---
 snag/src/build_db.c   | 40 ++++++++++++++++++++++++++++++++--------
 snag/src/sandboxing.c |  2 +-
 2 files changed, 33 insertions(+), 9 deletions(-)

(limited to 'snag/src')

diff --git a/snag/src/build_db.c b/snag/src/build_db.c
index 54a20cd..7e22e09 100644
--- a/snag/src/build_db.c
+++ b/snag/src/build_db.c
@@ -100,22 +100,42 @@ bool set_child_sandbox(const package_build_t* build) {
     if (!landlock_add_path_rule(landlock_fd, &ruleset_attr, "/lib", &path_beneath)) {
         return false;
     }
-    // this is just specific to my system - (rjb)
-    if (!landlock_add_path_rule(landlock_fd, &ruleset_attr, "/opt/gnome/lib64/libglib-2.0.so.0", &path_beneath)) {
+    if (!landlock_add_path_rule(landlock_fd, &ruleset_attr, "/usr/lib64", &path_beneath)) {
+        return false;
+    }
+    if (!landlock_add_path_rule(landlock_fd, &ruleset_attr, "/usr/lib", &path_beneath)) {
         return false;
     }
+    if (!landlock_add_path_rule(landlock_fd, &ruleset_attr, "/usr/libexec", &path_beneath)) {
+        return false;
+    }
+    if (!landlock_add_path_rule(landlock_fd, &ruleset_attr, "/usr", &path_beneath)) {
+        return false;
+    }
+    // this is just specific to my system - (rjb)
+    if (!landlock_add_path_rule(landlock_fd, &ruleset_attr, "/opt/gnome/lib64", &path_beneath)) {
+    }
     path_beneath.allowed_access =
-        LANDLOCK_ACCESS_FS_READ_FILE |
-        LANDLOCK_ACCESS_FS_WRITE_FILE |
-        LANDLOCK_ACCESS_FS_MAKE_FIFO |
-        LANDLOCK_ACCESS_FS_READ_DIR;
+            LANDLOCK_ACCESS_FS_WRITE_FILE |
+            LANDLOCK_ACCESS_FS_READ_FILE |
+            LANDLOCK_ACCESS_FS_READ_DIR |
+            LANDLOCK_ACCESS_FS_REMOVE_DIR |
+            LANDLOCK_ACCESS_FS_REMOVE_FILE |
+            LANDLOCK_ACCESS_FS_MAKE_CHAR |
+            LANDLOCK_ACCESS_FS_MAKE_DIR |
+            LANDLOCK_ACCESS_FS_MAKE_REG |
+            LANDLOCK_ACCESS_FS_MAKE_SOCK |
+            LANDLOCK_ACCESS_FS_MAKE_FIFO |
+            LANDLOCK_ACCESS_FS_MAKE_BLOCK |
+            LANDLOCK_ACCESS_FS_MAKE_SYM |
+            LANDLOCK_ACCESS_FS_TRUNCATE;
     if (!landlock_add_path_rule(landlock_fd, &ruleset_attr, "/tmp", &path_beneath)) {
         return false;
     }
     path_beneath.allowed_access =
         LANDLOCK_ACCESS_FS_READ_FILE |
         LANDLOCK_ACCESS_FS_READ_DIR;
-    if (!landlock_add_path_rule(landlock_fd, &ruleset_attr, "/usr", &path_beneath)) {
+    if (!landlock_add_path_rule(landlock_fd, &ruleset_attr, "/etc", &path_beneath)) {
         return false;
     }
 
@@ -189,7 +209,11 @@ void build_run(const package_build_t* build) {
         snprintf(buf2, sizeof(buf2), "%d", api_to_sh[0]);
 		// exec into install script
 		chdir(build->source_directory);
-        set_child_sandbox(build);
+        if (!set_child_sandbox(build)) {
+            int finished = API_MESSAGE_FINISHED;
+            write(api_from_sh[1], &finished, sizeof(finished));
+            die("CHILD - landlock sandbox failed not running script");
+        }
         char* argv[] = { cfg.build_package_script, buf1, buf2, build->package->script_path, NULL };
         execv(cfg.build_package_script, argv);
         int finished = API_MESSAGE_FINISHED;
diff --git a/snag/src/sandboxing.c b/snag/src/sandboxing.c
index 5edc6ce..99c0dcc 100644
--- a/snag/src/sandboxing.c
+++ b/snag/src/sandboxing.c
@@ -11,7 +11,6 @@
 int create_new_landlock_ruleset(struct landlock_ruleset_attr* ruleset_attr) {
 
     int abi = landlock_create_ruleset(NULL, 0, LANDLOCK_CREATE_RULESET_VERSION);
-    print("landlock abi version: %d\n", abi);
     if (abi < 0) {
         /* Degrades gracefully if Landlock is not handled. */
         print("landlock is not enabled, sandboxing will not work\n");
@@ -98,4 +97,5 @@ bool landlock_enforce(int landlock_fd) {
         return false;
     }
     close(landlock_fd);
+    return true;
 }
-- 
cgit v1.2.3