Documentation
¶
Overview ¶
Package sandbox confines agent-selected commands with Landlock. The worker re-executes itself with a landlock-exec subcommand, which calls Restrict and then execs the real program, because Go cannot run code between fork and exec.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ABI ¶
ABI reports the Landlock ABI version of the running kernel, or 0 when the kernel does not support Landlock or it is disabled.
func Restrict ¶
Restrict confines the calling thread to the system toolchain paths plus full access under runRoot. It is irreversible and inherited across exec, so call it from the thread that will exec the confined program.
func RestrictWithPaths ¶
RestrictWithPaths additionally grants full access to operator-selected writable state directories. Both path lists must come from trusted runtime configuration, never agent-controlled command arguments.
func RestrictWithReadExec ¶
RestrictWithReadExec confines the calling thread like Restrict and grants read/execute access to operator-selected toolchain paths. The caller must derive these paths from the worker environment, never agent input.
Types ¶
This section is empty.
Source Files