Skip to content

Commit

Permalink
Update user-guide to mention minimum version of landlock
Browse files Browse the repository at this point in the history
  • Loading branch information
boustrophedon committed Nov 10, 2023
1 parent 37a4cd6 commit 430d3ea
Showing 1 changed file with 4 additions and 2 deletions.
6 changes: 4 additions & 2 deletions user-guide.md
Original file line number Diff line number Diff line change
Expand Up @@ -141,10 +141,12 @@ However, there are some syscalls that only exist on certain architectures (e.g.

# Landlock

If the crate feature "landlock" is active, and a SafetyContext enables a RuleSet that provides a non-empty Vec from its `landlock_rules` method, Landlock will be enabled. Landlock can be applied independently of seccomp by using the `SafetyContext::landlock_only()` before applying the context to the current thread.

Landlock allows you to restrict access to the filesystem via a variety of [access rights](https://www.kernel.org/doc/html/latest/userspace-api/landlock.html#access-rights). These access rights are applied either to existing files, or on existing directories, in which case the right will apply to all subdirectories and subfiles.

Extrasafe currently requires V2 of the landlock ABI, which was introduced in Linux kernel 5.19.

If the crate feature "landlock" is active, and a SafetyContext enables a RuleSet that provides a non-empty Vec from its `landlock_rules` method, Landlock will be enabled. Landlock can be applied independently of seccomp by using the `SafetyContext::landlock_only()` before applying the context to the current thread.

The easiest way to use Landlock is via the SystemIO ruleset, which provides methods like `allow_create_in_dir`, `allow_read_path`, and `allow_write_file`.

If you want to implement your own LandlockRules, you can look at the `extrasafe::landlock::access` module to see what is currently exposed or you can use the [AccessFs](https://docs.rs/landlock/latest/landlock/enum.AccessFs.html) enum directly and create `extrasafe::LandlockRule`s manually.
Expand Down

0 comments on commit 430d3ea

Please sign in to comment.