From 784ca98041cc3fd616bbffffd7804113d173e5c2 Mon Sep 17 00:00:00 2001 From: Andreas Kling Date: Fri, 19 Jun 2026 17:01:39 +0200 Subject: [PATCH] LibSandbox: Allow listing read-write directories Include directory read access in Landlock read-write directory rules. Without it, paths such as /dev/dri could be writable but not enumerable after sandboxing, which made Mesa fail while probing GPU devices. Allow the Compositor to open /dev/udmabuf as well when the device is present, matching the other GPU device nodes exposed to the process. --- Libraries/LibSandbox/Sandbox.cpp | 3 ++- Services/Compositor/SandboxLinux.cpp | 1 + 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/Libraries/LibSandbox/Sandbox.cpp b/Libraries/LibSandbox/Sandbox.cpp index aeb0e501e3..bb2e7fb6ab 100644 --- a/Libraries/LibSandbox/Sandbox.cpp +++ b/Libraries/LibSandbox/Sandbox.cpp @@ -494,7 +494,8 @@ ErrorOr restrict_filesystem_with_landlock(ReadonlySpan paths # endif if (landlock_path.is_directory) { - path_beneath.allowed_access |= LANDLOCK_ACCESS_FS_REMOVE_DIR + path_beneath.allowed_access |= LANDLOCK_ACCESS_FS_READ_DIR + | LANDLOCK_ACCESS_FS_REMOVE_DIR | LANDLOCK_ACCESS_FS_REMOVE_FILE | LANDLOCK_ACCESS_FS_MAKE_DIR | LANDLOCK_ACCESS_FS_MAKE_REG diff --git a/Services/Compositor/SandboxLinux.cpp b/Services/Compositor/SandboxLinux.cpp index 531b031f40..56b4359f01 100644 --- a/Services/Compositor/SandboxLinux.cpp +++ b/Services/Compositor/SandboxLinux.cpp @@ -33,6 +33,7 @@ ErrorOr apply_sandbox() TRY(Sandbox::add_landlock_path_if_exists(paths, "/usr/share/drirc.d"sv, Sandbox::LandlockPath::Access::ReadOnly)); TRY(Sandbox::add_landlock_path_if_exists(paths, "/usr/share/vulkan"sv, Sandbox::LandlockPath::Access::ReadOnly)); TRY(Sandbox::add_landlock_path_if_exists(paths, "/dev/dri"sv, Sandbox::LandlockPath::Access::ReadWrite)); + TRY(Sandbox::add_landlock_path_if_exists(paths, "/dev/udmabuf"sv, Sandbox::LandlockPath::Access::ReadWrite)); TRY(Sandbox::add_landlock_path_if_exists(paths, "/sys"sv, Sandbox::LandlockPath::Access::ReadOnly)); if (auto library_path = Core::Environment::get("LD_LIBRARY_PATH"sv); library_path.has_value()) { for (auto path : library_path->split_view(':'))