mirror of
https://github.com/safedep/pmg.git
synced 2026-08-03 07:24:09 +02:00
Abhisek DattaandGitHub
4c42ceca0e
* feat: Initial implementation of landlock based sandbox driver * fix: Handle seccom probe failure * fix: Remove unnecessary seccomp probe * fix: Use file based policy load * fix: Keep bpf filter in memory * fix: Use TSYNC for seccom filter * fix: Use TSYNC for seccom filter * fix: Update landlock translator * fix: Landlock sandbox implementation * fix: Landlock + seccomp based sandboxing on Linux * fix: Misc fixes * fix: Cleanup sandbox files * fix: Handle mandatory deny API change post merge * fix: Landlock write access translation * chore: Fix linter issues * ci: Use /tmp for npm cache for landlock
34 lines
1.0 KiB
Go
34 lines
1.0 KiB
Go
//go:build linux
|
|
|
|
package landlock
|
|
|
|
import (
|
|
"github.com/safedep/pmg/sandbox/platform"
|
|
"github.com/spf13/cobra"
|
|
)
|
|
|
|
// NewLandlockSandboxExecCommand returns the hidden Cobra command used as the
|
|
// helper process entry point for the Landlock sandbox driver.
|
|
func NewLandlockSandboxExecCommand() *cobra.Command {
|
|
var policyFile string
|
|
var auditSocket string
|
|
|
|
cmd := &cobra.Command{
|
|
Use: "__landlock_sandbox_exec",
|
|
Hidden: true,
|
|
// Skip parent pmg initialization (config, event log, analytics) —
|
|
// RunLandlockHelper sets up its own minimal logger.
|
|
PersistentPreRun: func(cmd *cobra.Command, args []string) {},
|
|
RunE: func(cmd *cobra.Command, args []string) error {
|
|
return platform.RunLandlockHelper(policyFile, auditSocket, args)
|
|
},
|
|
}
|
|
|
|
cmd.Flags().StringVar(&policyFile, "policy-file", "", "Path to policy JSON file")
|
|
cmd.Flags().StringVar(&auditSocket, "audit-socket", "", "Path to audit unix socket")
|
|
_ = cmd.MarkFlagRequired("policy-file")
|
|
_ = cmd.MarkFlagRequired("audit-socket")
|
|
|
|
return cmd
|
|
}
|