diff options
| author | Lasse Collin <lasse.collin@tukaani.org> | 2024-02-17 23:07:35 +0200 |
|---|---|---|
| committer | Lasse Collin <lasse.collin@tukaani.org> | 2024-02-17 23:07:35 +0200 |
| commit | 374868d81d473ab56556a1cfd6b1b36a1fab348b (patch) | |
| tree | 195da6ba1f931c4ec7783832428ea3c2bbcac2b5 /src/xz/file_io.h | |
| parent | xz: Tweak comments. (diff) | |
| download | xz-374868d81d473ab56556a1cfd6b1b36a1fab348b.tar.xz | |
xz: Move sandboxing code to sandbox.c and improve Landlock sandbox.
Landlock is now always used just like pledge(2) is: first in more
permissive mode and later (under certain common conditions) in
a strict mode that doesn't allow opening more files.
I put pledge(2) first in sandbox.c because it's the simplest API
to use and still somewhat fine-grained for basic applications.
So it's the simplest thing to understand for anyone reading sandbox.c.
Diffstat (limited to '')
| -rw-r--r-- | src/xz/file_io.h | 6 |
1 files changed, 0 insertions, 6 deletions
diff --git a/src/xz/file_io.h b/src/xz/file_io.h index b16a8faa..ae7e2f38 100644 --- a/src/xz/file_io.h +++ b/src/xz/file_io.h @@ -99,12 +99,6 @@ extern void io_write_to_user_abort_pipe(void); extern void io_no_sparse(void); -#ifdef ENABLE_SANDBOX -/// \brief main() calls this if conditions for sandboxing have been met. -extern void io_allow_sandbox(void); -#endif - - /// \brief Open the source file extern file_pair *io_open_src(const char *src_name); |