Re: R/O protection for lower level dirs

Hey Vitaly,

On Wed, Apr 3, 2024, at 5:20 PM, Vitaly Chikunov wrote:

> To add more detail, what I tried to achieve: rpmbuild installs into so
> called 'buildroot', which is (for ALT) '/usr/src/tmp/name-buildroot'
> directory inside of '/usr/src/tmp' TMPDIR (and '/usr/src' is a HONE). =
When
> %check section is performed some scripts may inadvertently modify
> buildroot content which I thought to block. But because TMPDIR should =
be
> unrestricted (and / and HOME are not need to be restricted) it is not
> possible by any means to restrict buildroot.

As Micka=C3=ABl mentions this can be achieved by re-arranging the direct=
ory
structure. However I'd like to point out a second option (which doesn't
directly involve landlock) and that is to create a new overlay between
`%build` and `%check` which you throw away again before `%install`.

Any inadvertent changes during `%check` would then be irrelevant for the
`%install` section.

Regards,

Simon