From 013de9803239efe8d12020fa0a734ab2904e9bfb Mon Sep 17 00:00:00 2001 From: Vincent Douillet Date: Sat, 11 Jul 2026 22:23:27 +0200 Subject: wip: linux: add landlock sandbox --- main.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) (limited to 'main.c') diff --git a/main.c b/main.c index cffd658..79d9df0 100644 --- a/main.c +++ b/main.c @@ -41,6 +41,9 @@ #include "download.h" #include "http.h" #include "upload.h" +#ifdef __Linux__ +#include "vll_sandbox.h" +#endif /* __Linux__ */ enum page { PAGE_BROWSE, @@ -63,6 +66,9 @@ int main(void) { char *data_dir; +#ifdef __Linux__ + int vll_ruleset_id; +#endif /* __Linux__ */ enum kcgi_err parse_err; struct kreq r; @@ -97,6 +103,22 @@ main(void) goto end; } #endif /* __OpenBSD__ */ +#ifdef __Linux__ + vll_ruleset_id = vll_create_ruleset(); + if (vll_ruleset_id < 0) { + http_exit(&r, KHTTP_500, "vll_ruleset_id failed"); + goto end; + } + if (-1 == vll_add_rule(vll_ruleset_id, data_dir, VLL_READ | VLL_WRITE) + || -1 == vll_add_rule(vll_ruleset_id, TEMPLATE_DIR, VLL_READ)) { + http_exit(&r, KHTTP_500, "vll_add_rule failed"); + goto end; + } + if (-1 == vll_restrict_self(vll_ruleset_id)) { + http_exit(&r, KHTTP_500, "vrr_restrict_self failed"); + goto end; + } +#endif /* __Linux__ */ /* * Make sure basic request parameters are as expected : GET or POST, -- cgit v1.2.3