[PATCH v2 3/4] samples/landlock: Extend sample tool to support LANDLOCK_ACCESS_FS_TRUNCATE

[Mickaël Salaün]

On 12/07/2022 23:14, Günther Noack wrote:
> The sample tool will restrict the truncate operation if possible with
> the current kernel.

"Update the sandboxer sample to restrict truncate actions.  This is 
automatically enabled by default if the running kernel supports 
LANDLOCK_ACCESS_FS_TRUNCATE, except for the paths listed in the LL_FS_RW 
environment variable."


> 
> Signed-off-by: Günther Noack <gnoack3000 at gmail.com>
> Link: https://lore.kernel.org/all/20220707200612.132705-1-gnoack3000@gmail.com/
> ---
>   samples/landlock/sandboxer.c | 15 +++++++++++++--
>   1 file changed, 13 insertions(+), 2 deletions(-)
> 
> diff --git a/samples/landlock/sandboxer.c b/samples/landlock/sandboxer.c
> index 3e404e51ec64..4c3ed0097ffd 100644
> --- a/samples/landlock/sandboxer.c
> +++ b/samples/landlock/sandboxer.c
> @@ -76,7 +76,8 @@ static int parse_path(char *env_path, const char ***const path_list)
>   #define ACCESS_FILE ( \
>   	LANDLOCK_ACCESS_FS_EXECUTE | \
>   	LANDLOCK_ACCESS_FS_WRITE_FILE | \
> -	LANDLOCK_ACCESS_FS_READ_FILE)
> +	LANDLOCK_ACCESS_FS_READ_FILE | \
> +	LANDLOCK_ACCESS_FS_TRUNCATE)
>   
>   /* clang-format on */
>   
> @@ -160,11 +161,15 @@ static int populate_ruleset(const char *const env_var, const int ruleset_fd,
>   	LANDLOCK_ACCESS_FS_MAKE_FIFO | \
>   	LANDLOCK_ACCESS_FS_MAKE_BLOCK | \
>   	LANDLOCK_ACCESS_FS_MAKE_SYM | \
> -	LANDLOCK_ACCESS_FS_REFER)
> +	LANDLOCK_ACCESS_FS_REFER | \
> +	LANDLOCK_ACCESS_FS_TRUNCATE)
>   
>   #define ACCESS_ABI_2 ( \
>   	LANDLOCK_ACCESS_FS_REFER)
>   
> +#define ACCESS_ABI_3 ( \
> +	LANDLOCK_ACCESS_FS_TRUNCATE)
> +
>   /* clang-format on */
>   
>   int main(const int argc, char *const argv[], char *const *const envp)
> @@ -226,6 +231,12 @@ int main(const int argc, char *const argv[], char *const *const envp)
>   		return 1;
>   	}
>   	/* Best-effort security. */
> +	if (abi < 3) {
> +		ruleset_attr.handled_access_fs &= ~ACCESS_ABI_3;
> +		access_fs_ro &= ~ACCESS_ABI_3;
> +		access_fs_rw &= ~ACCESS_ABI_3;
> +	}

I think it is a good time to start replacing this "if" check with a 
switch one:

switch (abi) {
case 1:
	ruleset_attr.handled_access_fs &= ~ACCESS_ABI_2;
	access_fs_rw &= ~ACCESS_ABI_2;
	__attribute__((fallthrough));
case 2:
	ruleset_attr.handled_access_fs &= ~ACCESS_ABI_3;
	access_fs_rw &= ~ACCESS_ABI_3;
}


> +
>   	if (abi < 2) {
>   		ruleset_attr.handled_access_fs &= ~ACCESS_ABI_2;
>   		access_fs_ro &= ~ACCESS_ABI_2;