R/O protection for lower level dirs

[Vitaly Chikunov <vt@altlinux.org>]

Hi, 

I want to ensure that some deeper directory is write protected (as a non
security measure but so that some post-install processing do not
accidentally touch installed files).  Is there a way to achieve this
with Landlock?

For example, if we do R/W access to / (root tree is already protected
enough with DAC) and then R/O access to /home we still get full R/W access
everywhere and /home seems not restricted. Also, Landlock does not warn for
such configuration, silently accepting it as valid.

Practical example:

  ~$ LL_FS_RW=/ LL_FS_RO=/home sandboxer touch a
  Executing the sandboxed command...
  ~$ ls -l a
  -rw-r--r-- 1 vt vt 0 Apr  1 15:53 a

Thanks,