From 10f8b1c2214bf75cc2d755956c57bac193fe6427 Mon Sep 17 00:00:00 2001 From: Ophestra Date: Tue, 7 Apr 2026 12:44:07 +0900 Subject: internal/pkg: optional landlock LSM The alpine linux riscv64 kernel does not enable Landlock LSM, and kernel compilation is not yet feasible. Signed-off-by: Ophestra --- internal/pkg/pkg.go | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'internal/pkg/pkg.go') diff --git a/internal/pkg/pkg.go b/internal/pkg/pkg.go index ccb7541e..1ecd4b5c 100644 --- a/internal/pkg/pkg.go +++ b/internal/pkg/pkg.go @@ -521,6 +521,14 @@ const ( // was caused by an incorrect checksum accidentally left behind while // bumping a package. Only enable this if you are really sure you need it. CAssumeChecksum + + // CHostAbstract disables restriction of sandboxed processes from connecting + // to an abstract UNIX socket created by a host process. + // + // This is considered less secure in some systems, but does not introduce + // impurity due to [KindExecNet] being [KnownChecksum]. This flag exists + // to support kernels without Landlock LSM enabled. + CHostAbstract ) // Cache is a support layer that implementations of [Artifact] can use to store -- cgit v1.3.1