ba87a32626
Move the Linux no_new_privs, Landlock, and seccomp policy plumbing into LibSandbox so individual services can describe the privileges they need without copying the BPF and kernel feature detection machinery. Keep ImageDecoder's sandbox policy service-local by composing the new building blocks in SandboxLinux.cpp. This preserves the existing syscall allowlist while making the policy easier to audit and reuse.
29 lines
642 B
C++
29 lines
642 B
C++
/*
|
|
* Copyright (c) 2026-present, the Ladybird developers.
|
|
*
|
|
* SPDX-License-Identifier: BSD-2-Clause
|
|
*/
|
|
|
|
#include <ImageDecoder/Sandbox.h>
|
|
#include <LibSandbox/Sandbox.h>
|
|
#include <LibSandbox/Seccomp.h>
|
|
|
|
namespace ImageDecoder {
|
|
|
|
ErrorOr<void> apply_sandbox()
|
|
{
|
|
TRY(Sandbox::install_no_new_privileges());
|
|
TRY(Sandbox::configure_runtime());
|
|
TRY(Sandbox::restrict_filesystem_with_landlock());
|
|
|
|
Sandbox::SeccompPolicy policy;
|
|
policy.deny_readonly_filesystem_probes();
|
|
policy.allow_file_descriptor_operations();
|
|
policy.allow_ipc();
|
|
policy.allow_common_runtime();
|
|
TRY(policy.install());
|
|
|
|
return {};
|
|
}
|
|
|
|
}
|