diff options
| author | Ophestra <cat@gensokyo.uk> | 2026-04-07 12:44:07 +0900 |
|---|---|---|
| committer | Ophestra <cat@gensokyo.uk> | 2026-04-07 12:44:07 +0900 |
| commit | 10f8b1c2214bf75cc2d755956c57bac193fe6427 (patch) | |
| tree | a7251d4da78d0b0bd3a9e2dd2ed26d029f6ee21a /internal/pkg/pkg.go | |
| parent | 6907700d672106cdce897d5979e4afb4f9b46a30 (diff) | |
internal/pkg: optional landlock LSM
The alpine linux riscv64 kernel does not enable Landlock LSM, and kernel compilation is not yet feasible.
Signed-off-by: Ophestra <cat@gensokyo.uk>
Diffstat (limited to 'internal/pkg/pkg.go')
| -rw-r--r-- | internal/pkg/pkg.go | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/internal/pkg/pkg.go b/internal/pkg/pkg.go index ccb7541e..1ecd4b5c 100644 --- a/internal/pkg/pkg.go +++ b/internal/pkg/pkg.go @@ -521,6 +521,14 @@ const ( // was caused by an incorrect checksum accidentally left behind while // bumping a package. Only enable this if you are really sure you need it. CAssumeChecksum + + // CHostAbstract disables restriction of sandboxed processes from connecting + // to an abstract UNIX socket created by a host process. + // + // This is considered less secure in some systems, but does not introduce + // impurity due to [KindExecNet] being [KnownChecksum]. This flag exists + // to support kernels without Landlock LSM enabled. + CHostAbstract ) // Cache is a support layer that implementations of [Artifact] can use to store |