From f2c1e06c218b997f4c686a59d901b5e1948e8001 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Micka=C3=ABl=20Sala=C3=BCn?= Date: Thu, 10 Feb 2022 18:09:52 +0100 Subject: [PATCH] portable: extend support for Landlock and fix error handling MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This add all the remaining currently supported (Linux >= 5.13) filesystem restrictions: creation, removal, reading, writing and executing. Fix the errno check with EOPNOTSUPP in case of kernel with Landlock support built-in but disabled at boot time. Signed-off-by: Mickaël Salaün --- compat/landlock.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/compat/landlock.c b/compat/landlock.c index 47a5209dbfe2..9a637bb0753f 100644 --- a/compat/landlock.c +++ b/compat/landlock.c @@ -76,7 +76,19 @@ landlock_no_fs(void) * rejecting *any* filesystem access, we still have to * list some "possible actions" here. */ - .handled_access_fs = LANDLOCK_ACCESS_FS_READ_FILE, + .handled_access_fs = LANDLOCK_ACCESS_FS_EXECUTE | \ + LANDLOCK_ACCESS_FS_READ_FILE | \ + LANDLOCK_ACCESS_FS_READ_DIR | \ + LANDLOCK_ACCESS_FS_WRITE_FILE | \ + LANDLOCK_ACCESS_FS_REMOVE_DIR | \ + LANDLOCK_ACCESS_FS_REMOVE_FILE | \ + LANDLOCK_ACCESS_FS_MAKE_CHAR | \ + LANDLOCK_ACCESS_FS_MAKE_DIR | \ + LANDLOCK_ACCESS_FS_MAKE_REG | \ + LANDLOCK_ACCESS_FS_MAKE_SOCK | \ + LANDLOCK_ACCESS_FS_MAKE_FIFO | \ + LANDLOCK_ACCESS_FS_MAKE_BLOCK | \ + LANDLOCK_ACCESS_FS_MAKE_SYM, }; int fd, saved_errno; @@ -86,7 +98,7 @@ landlock_no_fs(void) fd = landlock_create_ruleset(&rattr, sizeof(rattr), 0); if (fd == -1) { /* this kernel doesn't have landlock built in */ - if (errno == ENOSYS || errno == ENOTSUP) + if (errno == ENOSYS || errno == EOPNOTSUPP) return 0; return -1; } -- 2.34.1