dmaax/ladybird
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

LibSandbox: Allow listing read-write directories

Browse source 
Include directory read access in Landlock read-write directory rules.
Without it, paths such as /dev/dri could be writable but not enumerable
after sandboxing, which made Mesa fail while probing GPU devices.

Allow the Compositor to open /dev/udmabuf as well when the device is
present, matching the other GPU device nodes exposed to the process.
This commit is contained in:
Andreas Kling 2026-06-19 17:01:39 +02:00 committed by Alexander Kalenik
parent b759954486
commit 784ca98041
2 changed files with 3 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
Libraries/LibSandbox/Sandbox.cpp
View file

@ -494,7 +494,8 @@ ErrorOr<void> restrict_filesystem_with_landlock(ReadonlySpan<LandlockPath> paths
# endif # endif
if (landlock_path.is_directory) { if (landlock_path.is_directory) {
path_beneath.allowed_access |= LANDLOCK_ACCESS_FS_REMOVE_DIR path_beneath.allowed_access |= LANDLOCK_ACCESS_FS_READ_DIR
| LANDLOCK_ACCESS_FS_REMOVE_DIR
| LANDLOCK_ACCESS_FS_REMOVE_FILE | LANDLOCK_ACCESS_FS_REMOVE_FILE
| LANDLOCK_ACCESS_FS_MAKE_DIR | LANDLOCK_ACCESS_FS_MAKE_DIR
| LANDLOCK_ACCESS_FS_MAKE_REG | LANDLOCK_ACCESS_FS_MAKE_REG

1
Services/Compositor/SandboxLinux.cpp
View file

@ -33,6 +33,7 @@ ErrorOr<void> apply_sandbox()
TRY(Sandbox::add_landlock_path_if_exists(paths, "/usr/share/drirc.d"sv, Sandbox::LandlockPath::Access::ReadOnly)); TRY(Sandbox::add_landlock_path_if_exists(paths, "/usr/share/drirc.d"sv, Sandbox::LandlockPath::Access::ReadOnly));
TRY(Sandbox::add_landlock_path_if_exists(paths, "/usr/share/vulkan"sv, Sandbox::LandlockPath::Access::ReadOnly)); TRY(Sandbox::add_landlock_path_if_exists(paths, "/usr/share/vulkan"sv, Sandbox::LandlockPath::Access::ReadOnly));
TRY(Sandbox::add_landlock_path_if_exists(paths, "/dev/dri"sv, Sandbox::LandlockPath::Access::ReadWrite)); TRY(Sandbox::add_landlock_path_if_exists(paths, "/dev/dri"sv, Sandbox::LandlockPath::Access::ReadWrite));
TRY(Sandbox::add_landlock_path_if_exists(paths, "/dev/udmabuf"sv, Sandbox::LandlockPath::Access::ReadWrite));
TRY(Sandbox::add_landlock_path_if_exists(paths, "/sys"sv, Sandbox::LandlockPath::Access::ReadOnly)); TRY(Sandbox::add_landlock_path_if_exists(paths, "/sys"sv, Sandbox::LandlockPath::Access::ReadOnly));
if (auto library_path = Core::Environment::get("LD_LIBRARY_PATH"sv); library_path.has_value()) { if (auto library_path = Core::Environment::get("LD_LIBRARY_PATH"sv); library_path.has_value()) {
for (auto path : library_path->split_view(':')) for (auto path : library_path->split_view(':'))