From: Andreas Dolp <dev@andreas-dolp.de>
Date: Tue, 13 Jan 2026 18:51:26 +0000 (+0100)
Subject: Configure landlock LSM security sandbox, but disabled by default
X-Git-Tag: archive/raspbian/1%8.0.3-1+rpi1^2~10
X-Git-Url: https://dgit.raspbian.org/%22http:/www.example.com/cgi/%22https:/%22bookmarks:///%22http:/www.example.com/cgi/%22https:/%22bookmarks:/?a=commitdiff_plain;h=b300de65cbbf35ee6cd273ae7f1317971719c57b;p=suricata.git

Configure landlock LSM security sandbox, but disabled by default

Forwarded: not-needed
Last-Update: 2025-09-21


Gbp-Pq: Name configure-landlock.patch
---

diff --git a/configure.ac b/configure.ac
index b19bea7e..c063c638 100644
--- a/configure.ac
+++ b/configure.ac
@@ -2518,6 +2518,7 @@ else
     EXPAND_VARIABLE(datadir, e_datarulesdir, "/suricata/rules")
     EXPAND_VARIABLE(localstatedir, e_sghcachedir, "/lib/suricata/cache/sgh")
     EXPAND_VARIABLE(localstatedir, e_datadir, "/lib/suricata/data")
+    EXPAND_VARIABLE(localstatedir, e_libdir, "/lib/suricata")
     EXPAND_VARIABLE(localstatedir, e_defaultruledir, "/lib/suricata/rules")
 
     e_abs_srcdir=$(cd $srcdir && pwd)
@@ -2534,6 +2535,7 @@ AC_SUBST(e_sghcachedir)
 AC_DEFINE_UNQUOTED([SGH_CACHE_DIR],["$e_sghcachedir"],[Directory path for signature group head cache])
 AC_SUBST(e_datadir)
 AC_DEFINE_UNQUOTED([DATA_DIR],["$e_datadir"],[Our DATA_DIR])
+AC_SUBST(e_libdir)
 AC_SUBST(e_magic_file)
 AC_SUBST(e_magic_file_comment)
 AC_SUBST(e_enable_evelog)
diff --git a/suricata.yaml.in b/suricata.yaml.in
index efd81513..298f85f8 100644
--- a/suricata.yaml.in
+++ b/suricata.yaml.in
@@ -1322,8 +1322,8 @@ security:
   landlock:
     enabled: no
     directories:
-      #write:
-      #  - @e_rundir@
+      write:
+        - @e_libdir@
       # /usr and /etc folders are added to read list to allow
       # file magic to be used.
       read: