diff options
| author | Lasse Collin <lasse.collin@tukaani.org> | 2024-02-17 23:07:35 +0200 |
|---|---|---|
| committer | Lasse Collin <lasse.collin@tukaani.org> | 2024-02-17 23:07:35 +0200 |
| commit | cae9a5e0bf422e6c5e64180805904f7ed02dc3aa (patch) | |
| tree | 50c01bd7e95cc75e4b0578ce649afd084d431882 /src/xz/sandbox.h | |
| parent | xz: Support Landlock ABI version 4. (diff) | |
| download | xz-cae9a5e0bf422e6c5e64180805904f7ed02dc3aa.tar.xz | |
xz: Use stricter pledge(2) and Landlock sandbox.
This makes these sandboxing methods stricter when no files are
created or deleted. That is, it's a middle ground between the
initial sandbox and the strictest single-file-to-stdout sandbox:
this allows opening files for reading but output has to go to stdout.
Diffstat (limited to '')
| -rw-r--r-- | src/xz/sandbox.h | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/src/xz/sandbox.h b/src/xz/sandbox.h index 795c550f..f41b4725 100644 --- a/src/xz/sandbox.h +++ b/src/xz/sandbox.h @@ -21,6 +21,10 @@ extern void sandbox_init(void); +/// \brief Enable sandboxing that only allows opening files for reading +extern void sandbox_enable_read_only(void); + + /// \brief Tell sandboxing code that strict sandboxing can be used /// /// This function only sets a flag which will be read by |