commit 7d07d3b

cleanup rules

 1@@ -9,42 +9,48 @@
 2 #define LL_PRINTERR(fmt, ...) srv_debug(0, xs_fmt(fmt, __VA_ARGS__))
 3 #include "landloc.h"
 4 
 5-#define LL_R LANDLOCK_ACCESS_FS_READ_FILE
 6-#define LL_X LANDLOCK_ACCESS_FS_EXECUTE
 7-#define LL_RWCF (LL_R | LANDLOCK_ACCESS_FS_WRITE_FILE | LANDLOCK_ACCESS_FS_MAKE_REG | LANDLOCK_ACCESS_FS_TRUNCATE | LANDLOCK_ACCESS_FS_REMOVE_FILE | LANDLOCK_ACCESS_FS_REFER)
 8-#define LL_RWCD (LL_RWCF | LANDLOCK_ACCESS_FS_MAKE_DIR | LANDLOCK_ACCESS_FS_REMOVE_DIR)
 9-#define LL_UNIX (LL_R | LANDLOCK_ACCESS_FS_WRITE_FILE | LANDLOCK_ACCESS_FS_MAKE_SOCK)
10-#define LL_CONN LANDLOCK_ACCESS_NET_CONNECT_TCP
11-#define LL_BIND LANDLOCK_ACCESS_NET_BIND_TCP
12-
13 static
14 LL_BEGIN(sbox_enter_linux_, const char* basedir, const char *address, int smail) {
15 
16-    LL_PATH(basedir,                LL_RWCD);
17-    LL_PATH("/tmp",                 LL_RWCD);
18+    const unsigned long long
19+        r = LANDLOCK_ACCESS_FS_READ_DIR    |
20+            LANDLOCK_ACCESS_FS_READ_FILE,
21+        w = LANDLOCK_ACCESS_FS_WRITE_FILE  |
22+            LANDLOCK_ACCESS_FS_TRUNCATE,
23+        c = LANDLOCK_ACCESS_FS_MAKE_DIR    |
24+            LANDLOCK_ACCESS_FS_MAKE_REG    |
25+            LANDLOCK_ACCESS_FS_TRUNCATE    |
26+            LANDLOCK_ACCESS_FS_MAKE_SYM    |
27+            LANDLOCK_ACCESS_FS_REMOVE_DIR  |
28+            LANDLOCK_ACCESS_FS_REMOVE_FILE |
29+            LANDLOCK_ACCESS_FS_REFER,
30+        s = LANDLOCK_ACCESS_FS_MAKE_SOCK,
31+        x = LANDLOCK_ACCESS_FS_EXECUTE;
32+
33+    LL_PATH(basedir,                r|w|c);
34+    LL_PATH("/tmp",                 r|w|c);
35 #ifndef WITHOUT_SHM
36-    LL_PATH("/dev/shm",             LL_RWCF);
37+    LL_PATH("/dev/shm",             r|w|c);
38 #endif
39-    LL_PATH("/etc/resolv.conf",     LL_R  );
40-    LL_PATH("/etc/hosts",           LL_R  );
41-    LL_PATH("/etc/ssl/openssl.cnf", LL_R  );
42-    LL_PATH("/etc/ssl/cert.pem",    LL_R  );
43-    LL_PATH("/usr/share/zoneinfo",  LL_R  );
44+    LL_PATH("/etc/resolv.conf",     r    );
45+    LL_PATH("/etc/hosts",           r    );
46+    LL_PATH("/etc/ssl/openssl.cnf", r    );
47+    LL_PATH("/etc/ssl/cert.pem",    r    );
48+    LL_PATH("/usr/share/zoneinfo",  r    );
49 
50     if (*address == '/')
51-        LL_PATH(address, LL_UNIX);
52+        LL_PATH(address, s);
53 
54     if (smail)
55-        LL_PATH("/usr/sbin/sendmail", LL_X);
56-
57+        LL_PATH("/usr/sbin/sendmail", x);
58 
59     if (*address != '/') {
60-        LL_PORT(
61-            (unsigned short)xs_number_get(xs_dict_get(srv_config, "port")), LL_BIND);
62+        unsigned short listen_port = xs_number_get(xs_dict_get(srv_config, "port"));
63+        LL_PORT(listen_port, LANDLOCK_ACCESS_NET_BIND_TCP);
64     }
65 
66-    LL_PORT(80,  LL_CONN);
67-    LL_PORT(443, LL_CONN);
68+    LL_PORT(80,  LANDLOCK_ACCESS_NET_CONNECT_TCP);
69+    LL_PORT(443, LANDLOCK_ACCESS_NET_CONNECT_TCP);
70 
71 } LL_END
72