sandbox

func Apply ¶

func Apply(workDir string) error

Apply restricts all the threads of the current process, and the restrictions cannot be removed. After Apply, the process:

• can read and write only in workDir,
• can read only the system files that TLS, DNS and time zones need,
• cannot start a program, trace or read the memory of another process,
• can open TCP connections only to the ports 443 and 53,
• cannot send signals to processes outside of its Landlock domain.

func Available ¶

func Available() error

Available returns an error if the kernel cannot enforce the sandbox.