fix(module_host): grant Landlock access to IPC socket path

Browse source

Out-of-process modules timed out with "did not report ready within 45s"
because apply_sandbox never allowed the child to reach breadd's Unix
socket. Path-based AF_UNIX connect is mediated as filesystem access, so
without a rule for the socket (and its parent) UnixStream::connect failed
with EACCES and the hello handshake never completed.

Pass socket_path into apply_sandbox and add baseline ReadDir/ReadFile
rules for the socket directory and path, matching the existing module-
directory grant. Update unit-test call sites accordingly.

...

This commit is contained in:

Breadway 2026-08-05 10:01:58 +08:00

parent 81fbc46e4f

commit da889d6f6a

12 changed files with 31458 additions and 30915 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

320

graphify-out/graph.html Normal file

View file

File diff suppressed because one or more lines are too long