diff options
| -rw-r--r-- | samples/landlock/sandboxer.c | 17 |
1 files changed, 16 insertions, 1 deletions
diff --git a/samples/landlock/sandboxer.c b/samples/landlock/sandboxer.c index fd4237c64fb2..e2056c8b902c 100644 --- a/samples/landlock/sandboxer.c +++ b/samples/landlock/sandboxer.c @@ -234,7 +234,22 @@ int main(const int argc, char *const argv[], char *const *const envp) /* Best-effort security. */ switch (abi) { case 1: - /* Removes LANDLOCK_ACCESS_FS_REFER for ABI < 2 */ + /* + * Removes LANDLOCK_ACCESS_FS_REFER for ABI < 2 + * + * Note: The "refer" operations (file renaming and linking + * across different directories) are always forbidden when using + * Landlock with ABI 1. + * + * If only ABI 1 is available, this sandboxer knowingly forbids + * refer operations. + * + * If a program *needs* to do refer operations after enabling + * Landlock, it can not use Landlock at ABI level 1. To be + * compatible with different kernel versions, such programs + * should then fall back to not restrict themselves at all if + * the running kernel only supports ABI 1. + */ ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_REFER; __attribute__((fallthrough)); case 2: |