Some distros put sys/capability.h into libcap-dev or
similiar, which is a bit unforunate, we don't need
libcap-dev or anything like that.
Since we anyway only used the capget()/capset(), we can
just define a simple wrapper and call the syscall directly
and therefore avoid above mentioned issue.
We cannot assume that landlock is enabled if we can compile it.
Even if it's enabled in the kernel it may still not be loaded.
We fill fallback to chroot/bind-mounts if we can.
If we can't (because path policies have landlock-specific options),
we can't do that either.
Closes: #21
89749bd03b至371c6a94b6371c6a94b6至ac3e84ed16Test for blacklist:
WIP low-level seccomp arg filter interface改為 WIP pledge/low-level seccomp arg filter interface7bfa7f5961至08a2445c26fa473601d3至eca3b3d622eca3b3d622至c7991ceefa9a95ad0c6a至34b58c5b3245f5f16bb8至d742397b52beeae95fe1至72ee3b3d7472ee3b3d74至a7a9c6962a3e4ae74203至ca0f82790cMerged
關閉合併請求