usage.c, checkcfg.c

src/firejail/checkcfg.c

@@ -363,6 +363,13 @@ static const char *const compiletime_support =
 		"disabled"
 #endif
 
+	"\n\t- Landlock support is "
+#ifdef HAVE_LANDLOCK
+		"enabled"
+#else
+		"disabled"
+#endif
+
 	"\n\t- networking support is "
 #ifdef HAVE_NETWORK
 		"enabled"

src/firejail/usage.c

@@ -133,6 +133,12 @@ static const char *const usage_str =
 	"    --keep-fd - inherit open file descriptors to sandbox.\n"
 	"    --keep-shell-rc - do not copy shell rc files from /etc/skel\n"
 	"    --keep-var-tmp - /var/tmp directory is untouched.\n"
+	"    --landlock - add basic rules to the Landlock ruleset.\n"
+	"    --landlock.proc=no|ro|rw - add an access rule for /proc to the Landlock ruleset.\n"
+	"    --landlock.read=path - add a read access rule for the path to the Landlock ruleset.\n"
+	"    --landlock.write=path - add a write access rule for the path to the Landlock ruleset.\n"
+	"    --landlock.special=path - add an access rule for creating FIFO pipes, Unix domain sockets and block devices for the path to the Landlock ruleset.\n"
+	"    --landlock.execute=path - add an execution-permitting rule for the path to the Landlock ruleset.\n"
 	"    --list - list all sandboxes.\n"
 #ifdef HAVE_FILE_TRANSFER
 	"    --ls=name|pid dir_or_filename - list files in sandbox container.\n"