landlock is a new set of linux APIs that is conceptually similar to unveil(2): the idea is to restrict what a process can do on a specified part of the filesystem. There are some differences in the behaviour: the major one being that the landlock ruleset is inherited across execve(2). This just restricts the libexec helpers by completely revoking ANY filesystem access; after all they are the biggest attack surface. got send/fetch/clone *may* end up spawning ssh(1), so at the moment is not possible to landlock the main process. From Omar Polo.

Although there are definitions for timespec*() functions in libbsd, these were added fairly recently, which means not all non-BSD systems will have them. In such cases, provide a portable wrapper.

This adds the capability to compile got-portable on FreeBSD.

This commit modifies the GoT main branch to be able to compile it under linux.