diff options
| author | Ophestra <cat@gensokyo.uk> | 2026-04-10 23:56:45 +0900 |
|---|---|---|
| committer | Ophestra <cat@gensokyo.uk> | 2026-04-10 23:56:45 +0900 |
| commit | b39064037625d1757a65913086ec3a247ad5bb29 (patch) | |
| tree | 7fd59329e779e195aaadab8846996844e5f45974 /container/container.go | |
| parent | ad2c9f36cddfd8adcd06fbe9238d176a8eb89614 (diff) | |
internal/landlock: relocate from package container
This is not possible to use directly, so remove it from the public API.
Signed-off-by: Ophestra <cat@gensokyo.uk>
Diffstat (limited to 'container/container.go')
| -rw-r--r-- | container/container.go | 11 |
1 files changed, 7 insertions, 4 deletions
diff --git a/container/container.go b/container/container.go index aeea3dcc..a798084a 100644 --- a/container/container.go +++ b/container/container.go @@ -21,6 +21,7 @@ import ( "hakurei.app/container/std" "hakurei.app/ext" "hakurei.app/fhs" + "hakurei.app/internal/landlock" "hakurei.app/message" ) @@ -317,12 +318,14 @@ func (p *Container) Start() error { // landlock: depends on per-thread state but acts on a process group { - rulesetAttr := &RulesetAttr{Scoped: LANDLOCK_SCOPE_SIGNAL} + rulesetAttr := &landlock.RulesetAttr{ + Scoped: landlock.LANDLOCK_SCOPE_SIGNAL, + } if !p.HostAbstract { - rulesetAttr.Scoped |= LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET + rulesetAttr.Scoped |= landlock.LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET } - if abi, err := LandlockGetABI(); err != nil { + if abi, err := landlock.GetABI(); err != nil { if p.HostAbstract || !p.HostNet { // landlock can be skipped here as it restricts access // to resources already covered by namespaces (pid, net) @@ -351,7 +354,7 @@ func (p *Container) Start() error { } } else { p.msg.Verbosef("enforcing landlock ruleset %s", rulesetAttr) - if err = LandlockRestrictSelf(rulesetFd, 0); err != nil { + if err = landlock.RestrictSelf(rulesetFd, 0); err != nil { _ = Close(rulesetFd) return &StartError{ Fatal: true, |