Skip to content

Commit 903cfe8

Browse files
committed
samples/landlock: Print hints about ABI versions
Extend the help with the latest Landlock ABI version supported by the sandboxer. Inform users about the sandboxer or the kernel not being up-to-date. Make the version check code easier to update and harder to misuse. Cc: Paul Moore <paul@paul-moore.com> Signed-off-by: Mickaël Salaün <mic@digikod.net> Reviewed-by: Günther Noack <gnoack3000@gmail.com> Link: https://lore.kernel.org/r/20220923154207.3311629-2-mic@digikod.net
1 parent f76349c commit 903cfe8

File tree

1 file changed

+29
-8
lines changed

1 file changed

+29
-8
lines changed

samples/landlock/sandboxer.c

Lines changed: 29 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -162,11 +162,10 @@ static int populate_ruleset(const char *const env_var, const int ruleset_fd,
162162
LANDLOCK_ACCESS_FS_MAKE_SYM | \
163163
LANDLOCK_ACCESS_FS_REFER)
164164

165-
#define ACCESS_ABI_2 ( \
166-
LANDLOCK_ACCESS_FS_REFER)
167-
168165
/* clang-format on */
169166

167+
#define LANDLOCK_ABI_LAST 2
168+
170169
int main(const int argc, char *const argv[], char *const *const envp)
171170
{
172171
const char *cmd_path;
@@ -196,8 +195,12 @@ int main(const int argc, char *const argv[], char *const *const envp)
196195
"\nexample:\n"
197196
"%s=\"/bin:/lib:/usr:/proc:/etc:/dev/urandom\" "
198197
"%s=\"/dev/null:/dev/full:/dev/zero:/dev/pts:/tmp\" "
199-
"%s bash -i\n",
198+
"%s bash -i\n\n",
200199
ENV_FS_RO_NAME, ENV_FS_RW_NAME, argv[0]);
200+
fprintf(stderr,
201+
"This sandboxer can use Landlock features "
202+
"up to ABI version %d.\n",
203+
LANDLOCK_ABI_LAST);
201204
return 1;
202205
}
203206

@@ -225,12 +228,30 @@ int main(const int argc, char *const argv[], char *const *const envp)
225228
}
226229
return 1;
227230
}
231+
228232
/* Best-effort security. */
229-
if (abi < 2) {
230-
ruleset_attr.handled_access_fs &= ~ACCESS_ABI_2;
231-
access_fs_ro &= ~ACCESS_ABI_2;
232-
access_fs_rw &= ~ACCESS_ABI_2;
233+
switch (abi) {
234+
case 1:
235+
/* Removes LANDLOCK_ACCESS_FS_REFER for ABI < 2 */
236+
ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_REFER;
237+
238+
fprintf(stderr,
239+
"Hint: You should update the running kernel "
240+
"to leverage Landlock features "
241+
"provided by ABI version %d (instead of %d).\n",
242+
LANDLOCK_ABI_LAST, abi);
243+
__attribute__((fallthrough));
244+
case LANDLOCK_ABI_LAST:
245+
break;
246+
default:
247+
fprintf(stderr,
248+
"Hint: You should update this sandboxer "
249+
"to leverage Landlock features "
250+
"provided by ABI version %d (instead of %d).\n",
251+
abi, LANDLOCK_ABI_LAST);
233252
}
253+
access_fs_ro &= ruleset_attr.handled_access_fs;
254+
access_fs_rw &= ruleset_attr.handled_access_fs;
234255

235256
ruleset_fd =
236257
landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);

0 commit comments

Comments
 (0)