landlock

package

v0.11.1 Latest Latest Go to latest Published: Jun 26, 2026 License: Apache-2.0 Imports: 4 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/OpceanAI/Doki

Links

Open Source Insights

Documentation ¶

Index ¶

Constants
func ApplySandbox(cfg *SandboxConfig) error
func Available() bool
func GetABI() int
func MustAllowPath(cfg *SandboxConfig, path string, access uint64)
func MustAllowTCPPort(cfg *SandboxConfig, port uint16)
type FSRule
type IPCRule
type NetPortAttr
type NetRule
type PathBeneathAttr
type RulesetAttr
type SandboxConfig
- func DefaultContainerSandbox(rootfs string, ports []uint16) *SandboxConfig

Constants ¶

View Source

const (
	LandlockAccessFSExecute     = 1 << 0
	LandlockAccessFSWriteFile   = 1 << 1
	LandlockAccessFSReadFile    = 1 << 2
	LandlockAccessFSReadDir     = 1 << 3
	LandlockAccessFSRemoveDir   = 1 << 4
	LandlockAccessFSRemoveFile  = 1 << 5
	LandlockAccessFSMakeChar    = 1 << 6
	LandlockAccessFSMakeDir     = 1 << 7
	LandlockAccessFSMakeReg     = 1 << 8
	LandlockAccessFSMakeSock    = 1 << 9
	LandlockAccessFSMakeFIFO    = 1 << 10
	LandlockAccessFSMakeBlock   = 1 << 11
	LandlockAccessFSMakeSym     = 1 << 12
	LandlockAccessFSRefer       = 1 << 13
	LandlockAccessFSTruncate    = 1 << 14
	LandlockAccessFSIoctlDev    = 1 << 15
	LandlockAccessFSResolveUnix = 1 << 16

	LandlockAccessNetBindTCP    = 1 << 0
	LandlockAccessNetConnectTCP = 1 << 1

	LandlockScopeAbstractUnixSocket = 1 << 0
	LandlockScopeSignal             = 1 << 1

	LandlockRulePathBeneath = 1
	LandlockRuleNetPort     = 2
)

Variables ¶

This section is empty.

Functions ¶

func ApplySandbox ¶

func ApplySandbox(cfg *SandboxConfig) error

func Available ¶

func Available() bool

func GetABI ¶

func GetABI() int

func MustAllowPath ¶

func MustAllowPath(cfg *SandboxConfig, path string, access uint64)

func MustAllowTCPPort ¶

func MustAllowTCPPort(cfg *SandboxConfig, port uint16)

Types ¶

type FSRule ¶

type FSRule struct {
	Path   string
	Access uint64
}

type IPCRule ¶

type IPCRule struct {
	Scope uint32
}

type NetPortAttr ¶

type NetPortAttr struct {
	AllowedAccess uint32
	Port          uint64
}

type NetRule ¶

type NetRule struct {
	Port   uint16
	Access uint32
}

type PathBeneathAttr ¶

type PathBeneathAttr struct {
	AllowedAccess uint64
	ParentFd      int32
}

type RulesetAttr ¶

type RulesetAttr struct {
	HandledAccessFS  uint64
	HandledAccessNet uint32
	HandledScopeIPC  uint32
}

type SandboxConfig ¶

type SandboxConfig struct {
	FSRules  []FSRule
	NetRules []NetRule
	IPCRules []IPCRule
}

func DefaultContainerSandbox ¶

func DefaultContainerSandbox(rootfs string, ports []uint16) *SandboxConfig

Source Files ¶

View all Source files

landlock.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL