Changeset 20be11f

Timestamp:

04/11/2024 07:08:39 AM (5 weeks ago)

Author:

Xi Ruoyao <xry111@…>

Branches:

lazarus, trunk

Children:

608e1de1

Parents:

e8b98762

git-author:

Xi Ruoyao <xry111@…> (04/11/2024 07:06:02 AM)

git-committer:

Xi Ruoyao <xry111@…> (04/11/2024 07:08:39 AM)

Message:

tracker3-miners: Enable Landlock, and document security implications about disabling seccomp or Landlock

Files:

• gnome/platform/tracker3-miners-kernel.xml (added)
• gnome/platform/tracker3-miners.xml (modified) (5 diffs)
• kernel-config/gnome/platform/tracker3-miners.toml (added)

gnome/platform/tracker3-miners.xml

@@ -121 +121 @@
   </sect2>
 
+  <sect2 role="kernel" id="tracker3-miners-kernel">
+    <title>Kernel Configuration</title>
+
+    <para>
+      Enable the following options in the kernel configuration, then recompile
+      the kernel and reboot if necessary:
+    </para>
+
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+      href="tracker3-miners-kernel.xml"/>
+
+    <indexterm zone="tracker3-miners tracker3-miners-kernel">
+      <primary sortas="d-traker-miners">tracker-miners</primary>
+    </indexterm>
+  </sect2>
+
   <sect2 role="installation">
     <title>Installation of Tracker-miners</title>
@@ -163 +179 @@
             --buildtype=release \
             -Dman=false         \
-            -Dlandlock=disabled \
             ..                  &amp;&amp;
 ninja</userinput></screen>
@@ -174 +189 @@
             -Dsystemd_user_services=false \
             -Dman=false                   \
-            -Dlandlock=disabled           \
             ..                            &amp;&amp;
 ninja</userinput></screen>
@@ -215 +229 @@
     </para>
 
-    <para>
-      <parameter>-Dlandlock=disabled</parameter>: This switch disables the
-      Landlock file access sandbox due to it requiring additional kernel
-      configuration and packages such as selinux or AppArmor.
-    </para>
-
     <para revision="sysv">
       <parameter>-Dsystemd_user_services=false</parameter>: This switch prevents
@@ -231 +239 @@
       call filter. On some architectures, such as i686 and ARM, the functions
       that tracker-miners uses are not guarded properly, and tracker-miners
-      will get killed with a SIGSYS as a result.
+      will get killed with a SIGSYS as a result.  Note that disabling
+      seccomp might cause the system compromised more severely in case a
+      security vulnerability in tracker-miners or its dependencies is
+      exploited.
+    </para>
+
+    <para>
+      <option>-Dlandlock=disabled</option>: This switch disables the
+      Landlock file access sandbox.  Use it if you don't want to build the
+      kernel with Landlock support.  Note that disabling Landlock might
+      cause the system compromised more severely in case a security
+      vulnerability in tracker-miners or its dependencies is exploited.
     </para>