Some distros put sys/capability.h into libcap-dev or
similiar, which is a bit unforunate, we don't need
libcap-dev or anything like that.
Since we anyway only used the capget()/capset(), we can
just define a simple wrapper and call the syscall directly
and therefore avoid above mentioned issue.
We cannot assume that landlock is enabled if we can compile it.
Even if it's enabled in the kernel it may still not be loaded.
We fill fallback to chroot/bind-mounts if we can.
If we can't (because path policies have landlock-specific options),
we can't do that either.
Closes: #21
89749bd03bから371c6a94b6へ )371c6a94b6からac3e84ed16へ )Test for blacklist:
WIP low-level seccomp arg filter interfaceから WIP pledge/low-level seccomp arg filter interface に変更7bfa7f5961から08a2445c26へ )fa473601d3からeca3b3d622へ )eca3b3d622からc7991ceefaへ )9a95ad0c6aから34b58c5b32へ )45f5f16bb8からd742397b52へ )beeae95fe1から72ee3b3d74へ )72ee3b3d74からa7a9c6962aへ )3e4ae74203からca0f82790cへ )Merged
プルリクエストはクローズされました