sandbox-linux: include exile.hpp

sandbox/sandbox-linux.cpp

@@ -12,18 +12,13 @@
 #include <filesystem>
 #include <sys/mount.h>
 #include <sys/capability.h>
-#define HAVE_LANDLOCK 0
-#include <exile.h>
+#include <exile.hpp>
 #include "../logger.h"
 #include "../utils.h"
 #include "../random.h"
 
 #include "sandbox-linux.h"
 
-/* TODO: make a whitelist approach. So far we simply blacklist
- * obvious systemcalls. To whitelist, we need to analyse our
- * dependencies (http library, sqlite wrapper, sqlite lib etc.) */
-
 bool SandboxLinux::supported()
 {
 	std::fstream stream;
@@ -54,19 +49,19 @@ bool SandboxLinux::enable(std::vector<std::string> fsPaths)
 	}
 	for(unsigned int i = 0; i < fsPaths.size(); i++)
 	{
-		exile_append_path_policy(policy, EXILE_FS_ALLOW_ALL_READ | EXILE_FS_ALLOW_ALL_WRITE, fsPaths[i].c_str());
+		exile_append_path_policies(policy, EXILE_FS_ALLOW_ALL_READ | EXILE_FS_ALLOW_ALL_WRITE, fsPaths[i].c_str());
 	}
 	policy->drop_caps = 1;
 	policy->not_dumpable = 1;
 	policy->no_new_privs = 1;
 	policy->mount_path_policies_to_chroot = 1;
 	policy->vow_promises = EXILE_SYSCALL_VOW_STDIO | EXILE_SYSCALL_VOW_WPATH | EXILE_SYSCALL_VOW_CPATH |
-							  EXILE_SYSCALL_VOW_RPATH | EXILE_SYSCALL_VOW_INET | EXILE_SYSCALL_VOW_UNIX |
-							  EXILE_SYSCALL_VOW_THREAD;
+						   EXILE_SYSCALL_VOW_RPATH | EXILE_SYSCALL_VOW_INET | EXILE_SYSCALL_VOW_UNIX |
+						   EXILE_SYSCALL_VOW_THREAD;
 
 	if(exile_enable_policy(policy) != 0)
 	{
-		Logger::error() << "Sandbox: Activation of seccomp blacklist failed!";
+		Logger::error() << "Sandbox: Activation of exile failed!";
 		exile_free_policy(policy);
 		return false;
 	}

submodules/exile.h

@@ -1 +1 @@
-Subproject commit 4824c6eaa9043878daaba7b3778338f5bf913f06
+Subproject commit f2ca26010a2bb6d9e270d6ade2e8789c02ac3b31