Add landlock runtime detection

We cannot assume that landlock is enabled if we can compile it.
Even if it's enabled in the kernel it may still not be loaded.

We fill fallback to chroot/bind-mounts if we can.

If we can't (because path policies have landlock-specific options),
we can't do that either.

Closes: #21
Tento commit je obsažen v:
2021-12-27 16:51:06 +01:00
rodič 98c76089de
revize 6420ca1b40
2 změnil soubory, kde provedl 53 přidání a 3 odebrání

5
test.c
Zobrazit soubor

@@ -398,6 +398,11 @@ int test_seccomp_exile_pledge_multiple()
#if HAVE_LANDLOCK == 1
int test_landlock()
{
if(!exile_landlock_is_available())
{
printf("landlock not available, so cannot test\n");
return 1;
}
struct exile_policy *policy = exile_init_policy();
exile_append_path_policy(policy, EXILE_FS_ALLOW_ALL_READ, "/proc/self/fd");
xexile_enable_policy(policy);