mirror of
https://github.com/safedep/pmg.git
synced 2026-08-03 07:24:09 +02:00
Abhisek DattaandGitHub
4c42ceca0e
* feat: Initial implementation of landlock based sandbox driver * fix: Handle seccom probe failure * fix: Remove unnecessary seccomp probe * fix: Use file based policy load * fix: Keep bpf filter in memory * fix: Use TSYNC for seccom filter * fix: Use TSYNC for seccom filter * fix: Update landlock translator * fix: Landlock sandbox implementation * fix: Landlock + seccomp based sandboxing on Linux * fix: Misc fixes * fix: Cleanup sandbox files * fix: Handle mandatory deny API change post merge * fix: Landlock write access translation * chore: Fix linter issues * ci: Use /tmp for npm cache for landlock
38 lines
1.1 KiB
Go
38 lines
1.1 KiB
Go
//go:build linux
|
|
// +build linux
|
|
|
|
package platform
|
|
|
|
import (
|
|
"os"
|
|
|
|
"github.com/safedep/dry/log"
|
|
"github.com/safedep/pmg/sandbox"
|
|
)
|
|
|
|
// NewSandbox creates a platform-specific sandbox instance for Linux.
|
|
// Prefers Landlock (kernel 5.13+) with seccomp-notify for deny enforcement.
|
|
// Falls back to Bubblewrap if Landlock or seccomp-notify is unavailable.
|
|
// Set PMG_SANDBOX_DRIVER=bubblewrap to force Bubblewrap, or
|
|
// PMG_SANDBOX_DRIVER=landlock to force Landlock (no fallback — fails if
|
|
// Landlock is unavailable).
|
|
func NewSandbox() (sandbox.Sandbox, error) {
|
|
switch os.Getenv("PMG_SANDBOX_DRIVER") {
|
|
case "bubblewrap":
|
|
log.Debugf("PMG_SANDBOX_DRIVER=bubblewrap: forcing Bubblewrap sandbox")
|
|
return newBubblewrapSandbox()
|
|
case "landlock":
|
|
log.Debugf("PMG_SANDBOX_DRIVER=landlock: forcing Landlock sandbox")
|
|
return newLandlockSandbox()
|
|
}
|
|
|
|
sb, err := newLandlockSandbox()
|
|
if err == nil {
|
|
log.Debugf("Using Landlock sandbox driver (ABI V%d)", sb.(*landlockSandbox).abi.Version)
|
|
return sb, nil
|
|
}
|
|
|
|
log.Debugf("Landlock not available (%v), falling back to Bubblewrap", err)
|
|
return newBubblewrapSandbox()
|
|
}
|