From 88511a3712bcf8c1922ef21abc9e18798e61a80e Mon Sep 17 00:00:00 2001
From: Luca Boccassi <luca.boccassi@microsoft.com>
Date: Wed, 2 Jun 2021 19:13:05 +0100
Subject: [PATCH] TODO: mention the new Landlock LSM as a way to implement
 sandboxing for systemd --user

---
 TODO | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/TODO b/TODO
index 5e91ddffd5..0b6733aa35 100644
--- a/TODO
+++ b/TODO
@@ -858,6 +858,9 @@ Features:
   on PID 1 with the relevant signals, and makes relevant files in /sys and
   /proc (such as the sysrq stuff) unavailable
 
+* Support ReadWritePaths/ReadOnlyPaths/InaccessiblePaths in systemd --user instances
+  via the new unprivileged Landlock LSM (https://landlock.io)
+
 * make sure the ratelimit object can deal with USEC_INFINITY as way to turn off things
 
 * journalctl: make sure -f ends when the container indicated by -M terminates