commit 1a44f56
shtrophic
·
2024-12-26 14:22:39 +0000 UTC
parent a7ca400
import updated landloc.h
1 files changed,
+82,
-32
+82,
-32
1@@ -65,9 +65,13 @@ int main(void) {
2 #define __LANDLOC_H__
3
4 #ifndef __linux__
5-#error "no landlock without linux"
6+# error "no landlock without linux"
7 #endif
8
9+#include <linux/version.h>
10+
11+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 13, 0)
12+
13 #include <unistd.h>
14 #include <linux/landlock.h>
15 #include <sys/syscall.h>
16@@ -75,53 +79,89 @@ int main(void) {
17 #include <fcntl.h>
18
19 #ifndef O_PATH
20-#define O_PATH 010000000
21+# define O_PATH 010000000
22 #endif
23
24 #ifndef LL_PRINTERR
25-#define LL_PRINTERR(fmt, ...) (void)fmt;
26+# define LL_PRINTERR(fmt, ...) (void)fmt;
27 #else
28-#include <string.h>
29-#include <errno.h>
30+# include <string.h>
31+# include <errno.h>
32 #endif
33
34-#define LL_FS_ALL (\
35- LANDLOCK_ACCESS_FS_EXECUTE |\
36- LANDLOCK_ACCESS_FS_WRITE_FILE |\
37- LANDLOCK_ACCESS_FS_READ_FILE |\
38- LANDLOCK_ACCESS_FS_READ_DIR |\
39- LANDLOCK_ACCESS_FS_REMOVE_DIR |\
40- LANDLOCK_ACCESS_FS_REMOVE_FILE |\
41- LANDLOCK_ACCESS_FS_MAKE_CHAR |\
42- LANDLOCK_ACCESS_FS_MAKE_DIR |\
43- LANDLOCK_ACCESS_FS_MAKE_REG |\
44- LANDLOCK_ACCESS_FS_MAKE_SOCK |\
45- LANDLOCK_ACCESS_FS_MAKE_FIFO |\
46- LANDLOCK_ACCESS_FS_MAKE_BLOCK |\
47- LANDLOCK_ACCESS_FS_MAKE_SYM |\
48- LANDLOCK_ACCESS_FS_REFER |\
49- LANDLOCK_ACCESS_FS_TRUNCATE |\
50- LANDLOCK_ACCESS_FS_IOCTL_DEV )
51-
52-#define LL_NET_ALL (\
53- LANDLOCK_ACCESS_NET_BIND_TCP |\
54- LANDLOCK_ACCESS_NET_CONNECT_TCP )
55+#ifdef LANDLOCK_ACCESS_FS_REFER
56+# define __LL_FS_REFER_COMPAT LANDLOCK_ACCESS_FS_REFER
57+# define __LL_SWITCH_FS_REFER __rattr.handled_access_fs &= ~__LL_FS_REFER_COMPAT
58+#else
59+# define __LL_FS_REFER_COMPAT 0
60+# define __LL_SWITCH_FS_REFER (void)0
61+#endif
62+
63+#ifdef LANDLOCK_ACCESS_FS_TRUNCATE
64+# define __LL_FS_TRUNCATE_COMPAT LANDLOCK_ACCESS_FS_TRUNCATE
65+# define __LL_SWITCH_FS_TRUNCATE __rattr.handled_access_fs &= ~__LL_FS_TRUNCATE_COMPAT
66+#else
67+# define __LL_FS_TRUNCATE_COMPAT 0
68+# define __LL_SWITCH_FS_TRUNCATE (void)0
69+#endif
70+
71+#ifdef LANDLOCK_ACCESS_FS_IOCTL_DEV
72+# define __LL_FS_IOCTL_DEV_COMPAT LANDLOCK_ACCESS_FS_IOCTL_DEV
73+# define __LL_SWITCH_FS_IOCTL_DEV __rattr.handled_access_fs &= ~__LL_FS_IOCTL_DEV_COMPAT
74+#else
75+# define __LL_FS_IOCTL_DEV_COMPAT 0
76+# define __LL_SWITCH_FS_IOCTL_DEV (void)0
77+#endif
78+
79+#define LL_FS_ALL (\
80+ LANDLOCK_ACCESS_FS_EXECUTE |\
81+ LANDLOCK_ACCESS_FS_WRITE_FILE |\
82+ LANDLOCK_ACCESS_FS_READ_FILE |\
83+ LANDLOCK_ACCESS_FS_READ_DIR |\
84+ LANDLOCK_ACCESS_FS_REMOVE_DIR |\
85+ LANDLOCK_ACCESS_FS_REMOVE_FILE |\
86+ LANDLOCK_ACCESS_FS_MAKE_CHAR |\
87+ LANDLOCK_ACCESS_FS_MAKE_DIR |\
88+ LANDLOCK_ACCESS_FS_MAKE_REG |\
89+ LANDLOCK_ACCESS_FS_MAKE_SOCK |\
90+ LANDLOCK_ACCESS_FS_MAKE_FIFO |\
91+ LANDLOCK_ACCESS_FS_MAKE_BLOCK |\
92+ LANDLOCK_ACCESS_FS_MAKE_SYM |\
93+ __LL_FS_REFER_COMPAT |\
94+ __LL_FS_TRUNCATE_COMPAT |\
95+ __LL_FS_IOCTL_DEV_COMPAT )
96+
97+#if defined(LANDLOCK_ACCESS_NET_BIND_TCP) && defined(LANDLOCK_ACCESS_NET_CONNECT_TCP)
98+# define __LL_HAVE_NET
99+#endif
100+
101+#ifdef __LL_HAVE_NET
102+# define LL_NET_ALL (LANDLOCK_ACCESS_NET_BIND_TCP | LANDLOCK_ACCESS_NET_CONNECT_TCP)
103+# define __LL_DECLARE_NET struct landlock_net_port_attr __nattr = {0}
104+# define __LL_INIT_NET __rattr.handled_access_net = LL_NET_ALL
105+# define __LL_SWITCH_NET do { __rattr.handled_access_net &= ~(LANDLOCK_ACCESS_NET_BIND_TCP | LANDLOCK_ACCESS_NET_CONNECT_TCP); } while (0)
106+#else
107+# define LL_NET_ALL 0
108+# define __LL_DECLARE_NET (void)0
109+# define __LL_INIT_NET (void)0
110+# define __LL_SWITCH_NET (void)0
111+#endif
112
113 #define LL_BEGIN(function, ...) int function(__VA_ARGS__) {\
114 int ll_rule_fd, ll_abi;\
115 struct landlock_ruleset_attr __rattr = {0};\
116 struct landlock_path_beneath_attr __pattr = {0};\
117- struct landlock_net_port_attr __nattr = {0};\
118+ __LL_DECLARE_NET;\
119 int __err = 0;\
120 __rattr.handled_access_fs = LL_FS_ALL;\
121- __rattr.handled_access_net = LL_NET_ALL;\
122+ __LL_INIT_NET;\
123 ll_abi = (int)syscall(SYS_landlock_create_ruleset, NULL, 0, LANDLOCK_CREATE_RULESET_VERSION);\
124 switch (ll_abi) {\
125 case -1: return -1;\
126- case 1: __rattr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_REFER; __attribute__((fallthrough));\
127- case 2: __rattr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_TRUNCATE; __attribute__((fallthrough));\
128- case 3: __rattr.handled_access_net &= ~(LANDLOCK_ACCESS_NET_BIND_TCP | LANDLOCK_ACCESS_NET_CONNECT_TCP); __attribute__((fallthrough));\
129- case 4: __rattr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_IOCTL_DEV;\
130+ case 1: __LL_SWITCH_FS_REFER; __attribute__((fallthrough));\
131+ case 2: __LL_SWITCH_FS_TRUNCATE; __attribute__((fallthrough));\
132+ case 3: __LL_SWITCH_NET; __attribute__((fallthrough));\
133+ case 4: __LL_SWITCH_FS_IOCTL_DEV;\
134 default: break;\
135 }\
136 ll_rule_fd = (int)syscall(SYS_landlock_create_ruleset, &__rattr, sizeof(struct landlock_ruleset_attr), 0);\
137@@ -159,6 +199,8 @@ int main(void) {
138 close(__pattr.parent_fd);\
139 } while (0)
140
141+#ifdef __LL_HAVE_NET
142+
143 #define LL_PORT(p, rules) do {\
144 unsigned short __port = (p);\
145 __nattr.allowed_access = (rules);\
146@@ -172,4 +214,12 @@ int main(void) {
147 }\
148 } while (0)
149
150+#else
151+
152+#define LL_PORT(p, rules) do { (void)p; (void)rules; } while (0)
153+
154+#endif /* __LL_HAVE_NET */
155+
156+#endif /* KERNEL_VERSION(5, 13, 0) */
157+
158 #endif /* __LANDLOC_H__ */