wip: linux: add landlock sandboxlandlock

1 files changed, 22 insertions, 0 deletions

diff --git a/main.c b/main.c
index cffd658..79d9df0 100644
--- a/main.c
+++ b/main.c
@@ -41,6 +41,9 @@
 #include "download.h"
 #include "http.h"
 #include "upload.h"
+#ifdef __Linux__
+#include "vll_sandbox.h"
+#endif /* __Linux__ */
 
 enum page {
 	PAGE_BROWSE,
@@ -63,6 +66,9 @@ int
 main(void)
 {
 	char   *data_dir;
+#ifdef __Linux__
+    int     vll_ruleset_id;
+#endif /* __Linux__ */
 	enum kcgi_err parse_err;
 	struct kreq r;
 
@@ -97,6 +103,22 @@ main(void)
 		goto end;
 	}
 #endif /* __OpenBSD__ */
+#ifdef __Linux__
+    vll_ruleset_id = vll_create_ruleset();
+    if (vll_ruleset_id < 0) {
+        http_exit(&r, KHTTP_500, "vll_ruleset_id failed");
+        goto end;
+    }
+    if (-1 == vll_add_rule(vll_ruleset_id, data_dir, VLL_READ | VLL_WRITE)
+        || -1 == vll_add_rule(vll_ruleset_id, TEMPLATE_DIR, VLL_READ)) {
+        http_exit(&r, KHTTP_500, "vll_add_rule failed");
+        goto end;
+    }
+    if (-1 == vll_restrict_self(vll_ruleset_id)) {
+        http_exit(&r, KHTTP_500, "vrr_restrict_self failed");
+        goto end;
+    }
+#endif /* __Linux__ */
 
 	/*
 	 * Make sure basic request parameters are as expected : GET or POST,