Update config schema

Signed-off-by: Kailun Qin <[email protected]>
opencontainers · Aug 10, 2022 · 545f68d · 545f68d
1 parent 31df2fb
commit 545f68d
Show file tree

Hide file tree

Showing 2 changed files with 71 additions and 0 deletions.
diff --git a/schema/config-schema.json b/schema/config-schema.json
@@ -141,6 +141,20 @@
  "selinuxLabel": {
  "type": "string"
  },
+ "landlock": {
+ "type": "object",
+ "properties": {
+ "ruleset": {
+ "$ref": "defs.json#/definitions/LandlockRuleset"
+ },
+ "rules": {
+ "$ref": "defs.json#/definitions/LandlockRules"
+ },
+ "disableBestEffort": {
+ "type": "boolean"
+ }
+ }
+ },
  "noNewPrivileges": {
  "type": "boolean"
  },

diff --git a/schema/defs.json b/schema/defs.json
@@ -153,6 +153,63 @@
  },
  "annotations": {
  "$ref": "#/definitions/mapStringString"
+ },
+ "LandlockFSAction": {
+ "type": "string",
+ "enum": [
+ "execute",
+ "write_file",
+ "read_file",
+ "read_dir",
+ "remove_dir",
+ "remove_file",
+ "make_char",
+ "make_dir",
+ "make_reg",
+ "make_sock",
+ "make_fifo",
+ "make_block",
+ "make_sym"
+ ]
+ },
+ "ArrayOfLandlockFSActions": {
+ "type": "array",
+ "items": {
+ "$ref": "#/definitions/LandlockFSAction"
+ }
+ },
+ "LandlockRuleset": {
+ "type": "object",
+ "properties": {
+ "handledAccessFS": {
+ "$ref": "#/definitions/ArrayOfLandlockFSActions"
+ }
+ }
+ },
+ "LandlockRulePathBeneath": {
+ "type": "object",
+ "properties": {
+ "allowedAccess": {
+ "$ref": "#/definitions/ArrayOfLandlockFSActions"
+ },
+ "paths": {
+ "$ref": "#/definitions/ArrayOfStrings"
+ }
+ }
+ },
+ "ArrayOfLandlockRulePathBeneaths": {
+ "type": "array",
+ "items": {
+ "$ref": "#/definitions/LandlockRulePathBeneath"
+ }
+ },
+ "LandlockRules": {
+ "type": "object",
+ "properties": {
+ "pathBeneath": {
+ "$ref": "#/definitions/ArrayOfLandlockRulePathBeneaths"
+ }
+ }
  }
  }
 }