24 lines
726 B
Plaintext
24 lines
726 B
Plaintext
# Complement to the exact-inode Landlock execution rule. This profile is not
|
|
# attached by executable pathname; the protected process enters its content-
|
|
# addressed name explicitly before accepting a private launcher grant.
|
|
profile @PROFILE@ flags=(attach_disconnected) {
|
|
capability,
|
|
network,
|
|
unix,
|
|
signal,
|
|
ptrace,
|
|
mount,
|
|
umount,
|
|
pivot_root,
|
|
userns,
|
|
/** rwklm,
|
|
/{usr,bin,sbin,opt,tmp,var,home}/** ix,
|
|
/run/archipelago-c01/bin/archipelago-runtime-proxy ix,
|
|
# Internal/disconnected executable objects are outside Landlock's ordinary
|
|
# inode allowlist. Keep these denied even after FD inheritance or SCM_RIGHTS.
|
|
deny /memfd:** x,
|
|
deny /SYSV** x,
|
|
deny /anon_inode:** x,
|
|
deny /secretmem** x,
|
|
}
|