diff options
Diffstat (limited to 'container/container.go')
| -rw-r--r-- | container/container.go | 11 |
1 files changed, 7 insertions, 4 deletions
diff --git a/container/container.go b/container/container.go index aeea3dcc..a798084a 100644 --- a/container/container.go +++ b/container/container.go @@ -21,6 +21,7 @@ import ( "hakurei.app/container/std" "hakurei.app/ext" "hakurei.app/fhs" + "hakurei.app/internal/landlock" "hakurei.app/message" ) @@ -317,12 +318,14 @@ func (p *Container) Start() error { // landlock: depends on per-thread state but acts on a process group { - rulesetAttr := &RulesetAttr{Scoped: LANDLOCK_SCOPE_SIGNAL} + rulesetAttr := &landlock.RulesetAttr{ + Scoped: landlock.LANDLOCK_SCOPE_SIGNAL, + } if !p.HostAbstract { - rulesetAttr.Scoped |= LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET + rulesetAttr.Scoped |= landlock.LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET } - if abi, err := LandlockGetABI(); err != nil { + if abi, err := landlock.GetABI(); err != nil { if p.HostAbstract || !p.HostNet { // landlock can be skipped here as it restricts access // to resources already covered by namespaces (pid, net) @@ -351,7 +354,7 @@ func (p *Container) Start() error { } } else { p.msg.Verbosef("enforcing landlock ruleset %s", rulesetAttr) - if err = LandlockRestrictSelf(rulesetFd, 0); err != nil { + if err = landlock.RestrictSelf(rulesetFd, 0); err != nil { _ = Close(rulesetFd) return &StartError{ Fatal: true, |