1 // SPDX-License-Identifier: 0BSD
3 ///////////////////////////////////////////////////////////////////////////////
6 /// \brief Sandbox support
8 // Author: Lasse Collin
10 ///////////////////////////////////////////////////////////////////////////////
12 #if defined(HAVE_PLEDGE) || defined(HAVE_LINUX_LANDLOCK) \
13 || defined(HAVE_CAP_RIGHTS_LIMIT)
14 # define ENABLE_SANDBOX 1
18 /// \brief Enables early sandboxing that can always be enabled
20 /// This requires that tuklib_progname() and io_init() have been called.
21 extern void sandbox_init(void);
24 /// \brief Enable sandboxing that only allows opening files for reading
25 extern void sandbox_enable_read_only(void);
28 /// \brief Tell sandboxing code that strict sandboxing can be used
30 /// This function only sets a flag which will be read by
31 /// sandbox_enable_strict_if_allowed().
32 extern void sandbox_allow_strict(void);
35 /// \brief Enable sandboxing that allows reading from one file
37 /// This does nothing if sandbox_allow_strict() hasn't been called.
39 /// \param src_fd File descriptor open for reading
40 /// \param pipe_event_fd user_abort_pipe[0] from file_io.c
41 /// \param pipe_write_fd user_abort_pipe[1] from file_io.c
42 extern void sandbox_enable_strict_if_allowed(
43 int src_fd
, int pipe_event_fd
, int pipe_write_fd
);