commit 629a795
shtrophic
·
2024-12-26 14:53:51 +0000 UTC
parent 1a44f56
use compat macros to compile on kernels without LANDLOCK_ACCESS_NET_*
+52,
-44
1@@ -90,57 +90,63 @@ int main(void) {
2 #endif
3
4 #ifdef LANDLOCK_ACCESS_FS_REFER
5-# define __LL_FS_REFER_COMPAT LANDLOCK_ACCESS_FS_REFER
6-# define __LL_SWITCH_FS_REFER __rattr.handled_access_fs &= ~__LL_FS_REFER_COMPAT
7+# define LANDLOCK_ACCESS_FS_REFER_COMPAT LANDLOCK_ACCESS_FS_REFER
8+# define __LL_SWITCH_FS_REFER __rattr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_REFER_COMPAT
9 #else
10-# define __LL_FS_REFER_COMPAT 0
11+# define LANDLOCK_ACCESS_FS_REFER_COMPAT 0
12 # define __LL_SWITCH_FS_REFER (void)0
13 #endif
14
15 #ifdef LANDLOCK_ACCESS_FS_TRUNCATE
16-# define __LL_FS_TRUNCATE_COMPAT LANDLOCK_ACCESS_FS_TRUNCATE
17-# define __LL_SWITCH_FS_TRUNCATE __rattr.handled_access_fs &= ~__LL_FS_TRUNCATE_COMPAT
18+# define LANDLOCK_ACCESS_FS_TRUNCATE_COMPAT LANDLOCK_ACCESS_FS_TRUNCATE
19+# define __LL_SWITCH_FS_TRUNCATE __rattr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_TRUNCATE_COMPAT
20 #else
21-# define __LL_FS_TRUNCATE_COMPAT 0
22+# define LANDLOCK_ACCESS_FS_TRUNCATE_COMPAT 0
23 # define __LL_SWITCH_FS_TRUNCATE (void)0
24 #endif
25
26 #ifdef LANDLOCK_ACCESS_FS_IOCTL_DEV
27-# define __LL_FS_IOCTL_DEV_COMPAT LANDLOCK_ACCESS_FS_IOCTL_DEV
28-# define __LL_SWITCH_FS_IOCTL_DEV __rattr.handled_access_fs &= ~__LL_FS_IOCTL_DEV_COMPAT
29+# define LANDLOCK_ACCESS_FS_IOCTL_DEV_COMPAT LANDLOCK_ACCESS_FS_IOCTL_DEV
30+# define __LL_SWITCH_FS_IOCTL_DEV __rattr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_IOCTL_DEV_COMPAT
31 #else
32-# define __LL_FS_IOCTL_DEV_COMPAT 0
33+# define LANDLOCK_ACCESS_FS_IOCTL_DEV_COMPAT 0
34 # define __LL_SWITCH_FS_IOCTL_DEV (void)0
35 #endif
36
37-#define LL_FS_ALL (\
38- LANDLOCK_ACCESS_FS_EXECUTE |\
39- LANDLOCK_ACCESS_FS_WRITE_FILE |\
40- LANDLOCK_ACCESS_FS_READ_FILE |\
41- LANDLOCK_ACCESS_FS_READ_DIR |\
42- LANDLOCK_ACCESS_FS_REMOVE_DIR |\
43- LANDLOCK_ACCESS_FS_REMOVE_FILE |\
44- LANDLOCK_ACCESS_FS_MAKE_CHAR |\
45- LANDLOCK_ACCESS_FS_MAKE_DIR |\
46- LANDLOCK_ACCESS_FS_MAKE_REG |\
47- LANDLOCK_ACCESS_FS_MAKE_SOCK |\
48- LANDLOCK_ACCESS_FS_MAKE_FIFO |\
49- LANDLOCK_ACCESS_FS_MAKE_BLOCK |\
50- LANDLOCK_ACCESS_FS_MAKE_SYM |\
51- __LL_FS_REFER_COMPAT |\
52- __LL_FS_TRUNCATE_COMPAT |\
53- __LL_FS_IOCTL_DEV_COMPAT )
54+#define LL_FS_ALL (\
55+ LANDLOCK_ACCESS_FS_EXECUTE |\
56+ LANDLOCK_ACCESS_FS_WRITE_FILE |\
57+ LANDLOCK_ACCESS_FS_READ_FILE |\
58+ LANDLOCK_ACCESS_FS_READ_DIR |\
59+ LANDLOCK_ACCESS_FS_REMOVE_DIR |\
60+ LANDLOCK_ACCESS_FS_REMOVE_FILE |\
61+ LANDLOCK_ACCESS_FS_MAKE_CHAR |\
62+ LANDLOCK_ACCESS_FS_MAKE_DIR |\
63+ LANDLOCK_ACCESS_FS_MAKE_REG |\
64+ LANDLOCK_ACCESS_FS_MAKE_SOCK |\
65+ LANDLOCK_ACCESS_FS_MAKE_FIFO |\
66+ LANDLOCK_ACCESS_FS_MAKE_BLOCK |\
67+ LANDLOCK_ACCESS_FS_MAKE_SYM |\
68+ LANDLOCK_ACCESS_FS_REFER_COMPAT |\
69+ LANDLOCK_ACCESS_FS_TRUNCATE_COMPAT |\
70+ LANDLOCK_ACCESS_FS_IOCTL_DEV_COMPAT )
71
72 #if defined(LANDLOCK_ACCESS_NET_BIND_TCP) && defined(LANDLOCK_ACCESS_NET_CONNECT_TCP)
73-# define __LL_HAVE_NET
74-#endif
75+# define LL_HAVE_NET 1
76+
77+# define LANDLOCK_ACCESS_NET_BIND_TCP_COMPAT LANDLOCK_ACCESS_NET_BIND_TCP
78+# define LANDLOCK_ACCESS_NET_CONNECT_TCP_COMPAT LANDLOCK_ACCESS_NET_CONNECT_TCP
79
80-#ifdef __LL_HAVE_NET
81-# define LL_NET_ALL (LANDLOCK_ACCESS_NET_BIND_TCP | LANDLOCK_ACCESS_NET_CONNECT_TCP)
82+# define LL_NET_ALL (LANDLOCK_ACCESS_NET_BIND_TCP_COMPAT | LANDLOCK_ACCESS_NET_CONNECT_TCP_COMPAT)
83 # define __LL_DECLARE_NET struct landlock_net_port_attr __nattr = {0}
84 # define __LL_INIT_NET __rattr.handled_access_net = LL_NET_ALL
85 # define __LL_SWITCH_NET do { __rattr.handled_access_net &= ~(LANDLOCK_ACCESS_NET_BIND_TCP | LANDLOCK_ACCESS_NET_CONNECT_TCP); } while (0)
86 #else
87+# define LL_HAVE_NET 0
88+
89+# define LANDLOCK_ACCESS_NET_BIND_TCP_COMPAT 0
90+# define LANDLOCK_ACCESS_NET_CONNECT_TCP_COMPAT 0
91+
92 # define LL_NET_ALL 0
93 # define __LL_DECLARE_NET (void)0
94 # define __LL_INIT_NET (void)0
95@@ -185,26 +191,28 @@ int main(void) {
96 #define LL_PATH(p, rules) do {\
97 const char *__path = (p);\
98 __pattr.allowed_access = (rules) & __rattr.handled_access_fs;\
99- __pattr.parent_fd = open(__path, O_PATH | O_CLOEXEC);\
100- if (-1 == __pattr.parent_fd) {\
101- LL_PRINTERR("open(%s): %s", __path, strerror(errno));\
102- __err = -1;\
103- goto __close;\
104- }\
105- __err = (int)syscall(SYS_landlock_add_rule, ll_rule_fd, LANDLOCK_RULE_PATH_BENEATH, &__pattr, 0);\
106- if (__err) {\
107- LL_PRINTERR("landlock_add_rule(%s): %s", __path, strerror(errno));\
108- goto __close;\
109+ if (__pattr.allowed_access != 0) {\
110+ __pattr.parent_fd = open(__path, O_PATH | O_CLOEXEC);\
111+ if (-1 == __pattr.parent_fd) {\
112+ LL_PRINTERR("open(%s): %s", __path, strerror(errno));\
113+ __err = -1;\
114+ goto __close;\
115+ }\
116+ __err = (int)syscall(SYS_landlock_add_rule, ll_rule_fd, LANDLOCK_RULE_PATH_BENEATH, &__pattr, 0);\
117+ if (__err) {\
118+ LL_PRINTERR("landlock_add_rule(%s): %s", __path, strerror(errno));\
119+ goto __close;\
120+ }\
121+ close(__pattr.parent_fd);\
122 }\
123- close(__pattr.parent_fd);\
124 } while (0)
125
126-#ifdef __LL_HAVE_NET
127+#if LL_HAVE_NET
128
129 #define LL_PORT(p, rules) do {\
130 unsigned short __port = (p);\
131 __nattr.allowed_access = (rules);\
132- if (ll_abi > 3) {\
133+ if (ll_abi > 3 && __nattr.allowed_access != 0) {\
134 __nattr.port = __port;\
135 __err = (int)syscall(SYS_landlock_add_rule, ll_rule_fd, LANDLOCK_RULE_NET_PORT, &__nattr, 0);\
136 if (__err) {\
137@@ -218,7 +226,7 @@ int main(void) {
138
139 #define LL_PORT(p, rules) do { (void)p; (void)rules; } while (0)
140
141-#endif /* __LL_HAVE_NET */
142+#endif /* LL_HAVE_NET */
143
144 #endif /* KERNEL_VERSION(5, 13, 0) */
145
+3,
-3
1@@ -46,11 +46,11 @@ LL_BEGIN(sbox_enter_linux_, const char* basedir, const char *address, int smail)
2
3 if (*address != '/') {
4 unsigned short listen_port = xs_number_get(xs_dict_get(srv_config, "port"));
5- LL_PORT(listen_port, LANDLOCK_ACCESS_NET_BIND_TCP);
6+ LL_PORT(listen_port, LANDLOCK_ACCESS_NET_BIND_TCP_COMPAT);
7 }
8
9- LL_PORT(80, LANDLOCK_ACCESS_NET_CONNECT_TCP);
10- LL_PORT(443, LANDLOCK_ACCESS_NET_CONNECT_TCP);
11+ LL_PORT(80, LANDLOCK_ACCESS_NET_CONNECT_TCP_COMPAT);
12+ LL_PORT(443, LANDLOCK_ACCESS_NET_CONNECT_TCP_COMPAT);
13
14 } LL_END
15