NAME

lbexec — run one build command in a lockbox

SYNOPSIS

DESCRIPTION

lbexec restricts itself with the Linux Landlock security module and then executes command. It is the per-command form of the lockbox described in lockbox(7): mkpkg(8) puts it in front of the lines of build() named in a recipe's lockbox array. It is not usually run by hand.

Which files may be read is taken from the package database, as for the full lockbox. The declared dependencies come from the environment that mkpkg(8) sets up; a declared one that is not installed is an error.

The options are as follows:

-p standard

The default. Read access to the base packages and the declared dependencies. Read and write access to MKPKG_WORK_DIR, SRC, PKG, PKGMK_SOURCE_DIR, /tmp and /dev; read access to /proc and /etc.

-p cargo

For cargo. The same packages and build directories as standard, but of /etc only /etc/ssl, and of CARGO_HOME only bin, env, .package-cache and toolchains, so the downloaded registry and git checkouts are not readable and vendored sources must be used. The command also runs in a new network namespace with only the loopback interface, if the kernel and privileges allow it; otherwise it runs with the network. mkpkg(8) sets TMPDIR to $SRC/tmp for this profile, because cargo renames files from TMPDIR into its target directory.

ENVIRONMENT

MKPKG_DEPENDS, MKPKG_MAKEDEPENDS

Space-separated package names from the recipe's depends and makedeps.

MKPKG_WORK_DIR, SRC, PKG, PKGMK_SOURCE_DIR

Build directories that stay writable.

CARGO_HOME

Cargo's home directory, for the cargo profile.

PKG_DBDIR

Package database directory, instead of /var/lib/pkg.

EXIT STATUS

On success lbexec does not return: its exit status is that of command. It exits 1 if the lockbox cannot be set up or command cannot be run.

SEE ALSO

MAKEPKG(5), lockbox(7), mkpkg(8)