commit 559f23c

add distinction between RWC with directories and without, include FS_REFER permission

 1@@ -113,13 +113,16 @@ void sbox_enter(const char *basedir)
 2 
 3 #define LL_R LANDLOCK_ACCESS_FS_READ_FILE
 4 #define LL_X LANDLOCK_ACCESS_FS_EXECUTE
 5-#define LL_RWC (LL_R | LANDLOCK_ACCESS_FS_WRITE_FILE | LANDLOCK_ACCESS_FS_MAKE_REG | LANDLOCK_ACCESS_FS_TRUNCATE)
 6-#define LL_UNX (LL_R | LANDLOCK_ACCESS_FS_WRITE_FILE | LANDLOCK_ACCESS_FS_MAKE_SOCK)
 7-#define LL_CON LANDLOCK_ACCESS_NET_CONNECT_TCP
 8-#define LL_BND LANDLOCK_ACCESS_NET_BIND_TCP
 9+#define LL_RWCF (LL_R | LANDLOCK_ACCESS_FS_WRITE_FILE | LANDLOCK_ACCESS_FS_MAKE_REG | LANDLOCK_ACCESS_FS_TRUNCATE | LANDLOCK_ACCESS_FS_REMOVE_FILE | LANDLOCK_ACCESS_FS_REFER)
10+#define LL_RWCD (LL_RWCF | LANDLOCK_ACCESS_FS_MAKE_DIR | LANDLOCK_ACCESS_FS_REMOVE_DIR)
11+#define LL_UNIX (LL_R | LANDLOCK_ACCESS_FS_WRITE_FILE | LANDLOCK_ACCESS_FS_MAKE_SOCK)
12+#define LL_CONN LANDLOCK_ACCESS_NET_CONNECT_TCP
13+#define LL_BIND LANDLOCK_ACCESS_NET_BIND_TCP
14 
15 #define LANDLOCK_PATH(p, r) do {\
16     path.allowed_access = r;\
17+    if (abi < 2)\
18+        path.allowed_access &= ~LANDLOCK_ACCESS_FS_REFER;\
19     if (abi < 3)\
20         path.allowed_access &= ~LANDLOCK_ACCESS_FS_TRUNCATE;\
21     path.parent_fd = open(p, O_PATH | O_CLOEXEC);\
22@@ -145,9 +148,9 @@ void sbox_enter(const char *basedir)
23     }\
24 } while (0)
25 
26-    LANDLOCK_PATH(basedir,                LL_RWC);
27-    LANDLOCK_PATH("/tmp",                 LL_RWC);
28-    LANDLOCK_PATH("/dev/shm",             LL_RWC);
29+    LANDLOCK_PATH(basedir,                LL_RWCD);
30+    LANDLOCK_PATH("/tmp",                 LL_RWCD);
31+    LANDLOCK_PATH("/dev/shm",             LL_RWCF);
32     LANDLOCK_PATH("/etc/resolv.conf",     LL_R  );
33     LANDLOCK_PATH("/etc/hosts",           LL_R  );
34     LANDLOCK_PATH("/etc/ssl/openssl.cnf", LL_R  );
35@@ -155,16 +158,16 @@ void sbox_enter(const char *basedir)
36     LANDLOCK_PATH("/usr/share/zoneinfo",  LL_R  );
37 
38     if (*address == '/')
39-        LANDLOCK_PATH(address, LL_UNX);
40+        LANDLOCK_PATH(address, LL_UNIX);
41 
42     if (abi > 3) {
43         if (*address != '/') {
44             LANDLOCK_PORT(
45-                (uint16_t)xs_number_get(xs_dict_get(srv_config, "port")), LL_BND);
46+                (uint16_t)xs_number_get(xs_dict_get(srv_config, "port")), LL_BIND);
47         }
48 
49-        LANDLOCK_PORT(80,  LL_CON);
50-        LANDLOCK_PORT(443, LL_CON);
51+        LANDLOCK_PORT(80,  LL_CONN);
52+        LANDLOCK_PORT(443, LL_CONN);
53     }
54     
55     if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {