Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Expose landlock API #11

Merged
merged 6 commits into from
Feb 21, 2024
Merged

Expose landlock API #11

merged 6 commits into from
Feb 21, 2024

Commits on Feb 20, 2024

  1. refact: move python submodule initialization to rust submodule

    @vlaci
    vlaci committed Feb 20, 2024
    Configuration menu
    Copy the full SHA
    71a93bd View commit details
    Browse the repository at this point in the history

  2. chore: allow importing submodule from python 

    This code makes it possible to import math as a Python
submodule. Extension modules are not packages, so their submodules
are not affected by the usual rules from import machinery.
    @vlaci
    vlaci committed Feb 20, 2024
    Configuration menu
    Copy the full SHA
    590617c View commit details
    Browse the repository at this point in the history

  3. chore: signature is no longer needed to provide named arguments

    @vlaci
    vlaci committed Feb 20, 2024
    Configuration menu
    Copy the full SHA
    9bacee3 View commit details
    Browse the repository at this point in the history

  4. chore: verbose build output in CI 

    The default output doesn't contain enough information to diagnose issues.
    @vlaci
    vlaci committed Feb 20, 2024
    Configuration menu
    Copy the full SHA
    ba264e4 View commit details
    Browse the repository at this point in the history

  5. feat: add landlock based access restriction functionality 

    Landlock is a kernel API for unprivileged access control. We take
advantage of it to limit where unblob can write to and read from on the
filesystem. This is a Linux-only feature that won't be enabled on OSX.

For more information, see https://docs.kernel.org/userspace-api/landlock.html

We use Landlock ABI version 2 since it introduced the
LANDLOCK_ACCESS_FS_REFER permission that's required to create hardlinks.

Co-authored-by: Quentin Kaiser <[email protected]>
    @vlaci @qkaiser
    vlaci and qkaiser committed Feb 20, 2024
    Configuration menu
    Copy the full SHA
    d04c2e4 View commit details
    Browse the repository at this point in the history

  6. fix: raise SandboxError exception if unsupported platform

    @qkaiser @vlaci
    qkaiser authored and vlaci committed Feb 20, 2024
    Configuration menu
    Copy the full SHA
    e2763ef View commit details
    Browse the repository at this point in the history