ba87a32626
Move the Linux no_new_privs, Landlock, and seccomp policy plumbing into LibSandbox so individual services can describe the privileges they need without copying the BPF and kernel feature detection machinery. Keep ImageDecoder's sandbox policy service-local by composing the new building blocks in SandboxLinux.cpp. This preserves the existing syscall allowlist while making the policy easier to audit and reuse.
11 lines
134 B
CMake
11 lines
134 B
CMake
set(SOURCES
|
|
Sandbox.cpp
|
|
)
|
|
|
|
if (LINUX)
|
|
list(APPEND SOURCES
|
|
Seccomp.cpp
|
|
)
|
|
endif()
|
|
|
|
ladybird_lib(LibSandbox sandbox)
|