.Dd September 27, 2026
.Dt LBEXEC 8
.Os
.Sh NAME
.Nm lbexec
.Nd run one build command in a lockbox
.Sh SYNOPSIS
.Nm
.Op Fl p Cm standard | cargo
.Ar command
.Op Ar argument ...
.Sh DESCRIPTION
.Nm
restricts itself with the Linux Landlock security module and then
executes
.Ar command .
It is the per-command form of the lockbox described in
.Xr lockbox 7 :
.Xr mkpkg 8
puts it in front of the lines of
.Fn build
named in a recipe's
.Va lockbox
array.
It is not usually run by hand.
.Pp
Which files may be read is taken from the package database, as for the
full lockbox.
The declared dependencies come from the environment that
.Xr mkpkg 8
sets up; a declared one that is not installed is an error.
.Pp
The options are as follows:
.Bl -tag -width Ds
.It Fl p Cm standard
The default.
Read access to the base packages and the declared dependencies.
Read and write access to
.Ev MKPKG_WORK_DIR ,
.Ev SRC ,
.Ev PKG ,
.Ev PKGMK_SOURCE_DIR ,
.Pa /tmp
and
.Pa /dev ;
read access to
.Pa /proc
and
.Pa /etc .
.It Fl p Cm cargo
For cargo.
The same packages and build directories as
.Cm standard ,
but of
.Pa /etc
only
.Pa /etc/ssl ,
and of
.Ev CARGO_HOME
only
.Pa bin ,
.Pa env ,
.Pa .package-cache
and
.Pa toolchains ,
so the downloaded registry and git checkouts are not readable and
vendored sources must be used.
The command also runs in a new network namespace with only the loopback
interface, if the kernel and privileges allow it; otherwise it runs
with the network.
.Xr mkpkg 8
sets
.Ev TMPDIR
to
.Pa $SRC/tmp
for this profile, because cargo renames files from
.Ev TMPDIR
into its target directory.
.El
.Sh ENVIRONMENT
.Bl -tag -width MKPKG_MAKEDEPENDS
.It Ev MKPKG_DEPENDS , MKPKG_MAKEDEPENDS
Space-separated package names from the recipe's
.Va depends
and
.Va makedeps .
.It Ev MKPKG_WORK_DIR , SRC , PKG , PKGMK_SOURCE_DIR
Build directories that stay writable.
.It Ev CARGO_HOME
Cargo's home directory, for the cargo profile.
.It Ev PKG_DBDIR
Package database directory, instead of
.Pa /var/lib/pkg .
.El
.Sh EXIT STATUS
On success
.Nm
does not return: its exit status is that of
.Ar command .
It exits 1 if the lockbox cannot be set up or
.Ar command
cannot be run.
.Sh SEE ALSO
.Xr MAKEPKG 5 ,
.Xr lockbox 7 ,
.Xr mkpkg 8