From a52e6baeaad60459a37c6e2c4a6ebd507ffcae83 Mon Sep 17 00:00:00 2001 From: Riley Beckett Date: Thu, 30 Jul 2026 23:51:35 -0400 Subject: package emacs --- snag/src/build_db.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) (limited to 'snag') diff --git a/snag/src/build_db.c b/snag/src/build_db.c index cb3785d..ad68be5 100644 --- a/snag/src/build_db.c +++ b/snag/src/build_db.c @@ -89,6 +89,12 @@ bool set_child_sandbox(const package_build_t* build) { if (!landlock_add_path_rule(landlock_fd, &ruleset_attr, build->package->script_path, &path_beneath)) { return false; } + path_beneath.allowed_access = + LANDLOCK_ACCESS_FS_READ_FILE | + LANDLOCK_ACCESS_FS_WRITE_FILE; + if (!landlock_add_path_rule(landlock_fd, &ruleset_attr, "/dev/null", &path_beneath)) { + return false; + } path_beneath.allowed_access = LANDLOCK_ACCESS_FS_EXECUTE | LANDLOCK_ACCESS_FS_READ_FILE | @@ -118,7 +124,7 @@ bool set_child_sandbox(const package_build_t* build) { return false; } // this is just specific to my system - (rjb) - if (!landlock_add_path_rule(landlock_fd, &ruleset_attr, "/opt/gnome/lib64", &path_beneath)) { + if (!landlock_add_path_rule(landlock_fd, &ruleset_attr, "/opt/gnome/", &path_beneath)) { } path_beneath.allowed_access = LANDLOCK_ACCESS_FS_WRITE_FILE | -- cgit v1.2.3