pacman 7.0 requires the kernel supports landlock, linux-aarch64-rockchip-bsp6.1-joshua-git 6.1.75
Archlinux pacman 7.0 has added support for downloading packages as a separate user with dropped privileges.
https://archlinux.org/news/manual-intervention-for-pacman-700-and-local-repositories-required/
This requires that the kernel supports landlock. Running with linux-aarch64-rockchip-bsp6.1-joshua-git 6.1.75 yields the following error.
error: restricting filesystem access failed because landlock is not supported by the kernel!
This doesn't stop pacman from updating, it just isn't utilizing the new security feature, which would be nice to have available.
I don't know if this does you any good, but adding the following to the PKGBUILD config file, added landlock to kernels I compile for Odroid N2 and Pinebook Pro.
change from
CONFIG_SECURITY_LANDLOCK is not set
to
CONFIG_SECURITY_LANDLOCK=y
and from
CONFIG_LSM="yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor"
to
CONFIG_LSM="yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,landlock"
For me, this added landlock to the kernel and the new feature works.
In an existing install, pacman will generate some .pacnew files that need to be dealt with, and a new user 'alpm' is created for support for downloading packages as a separate user with dropped privileges.
Thank you for the work on the linux-aarch64-rockchip-bsp6.1-joshua-git 6.1.75 kernel
关闭于 2024-10-16 5 条评论