[PATCH v2 3/4] samples/landlock: Extend sample tool to support LANDLOCK_ACCESS_FS_TRUNCATE

[Mickaël Salaün]

On 29/07/2022 12:31, Mickaël Salaün wrote:
> 
> On 12/07/2022 23:14, Günther Noack wrote:
>> The sample tool will restrict the truncate operation if possible with
>> the current kernel.
> 
> "Update the sandboxer sample to restrict truncate actions.  This is
> automatically enabled by default if the running kernel supports
> LANDLOCK_ACCESS_FS_TRUNCATE, except for the paths listed in the LL_FS_RW
> environment variable."
> 
> 
>>
>> Signed-off-by: Günther Noack <gnoack3000 at gmail.com>
>> Link: https://lore.kernel.org/all/20220707200612.132705-1-gnoack3000@gmail.com/
>> ---
>>    samples/landlock/sandboxer.c | 15 +++++++++++++--
>>    1 file changed, 13 insertions(+), 2 deletions(-)
>>
>> diff --git a/samples/landlock/sandboxer.c b/samples/landlock/sandboxer.c
>> index 3e404e51ec64..4c3ed0097ffd 100644
>> --- a/samples/landlock/sandboxer.c
>> +++ b/samples/landlock/sandboxer.c
>> @@ -76,7 +76,8 @@ static int parse_path(char *env_path, const char ***const path_list)
>>    #define ACCESS_FILE ( \
>>    	LANDLOCK_ACCESS_FS_EXECUTE | \
>>    	LANDLOCK_ACCESS_FS_WRITE_FILE | \
>> -	LANDLOCK_ACCESS_FS_READ_FILE)
>> +	LANDLOCK_ACCESS_FS_READ_FILE | \
>> +	LANDLOCK_ACCESS_FS_TRUNCATE)
>>    
>>    /* clang-format on */
>>    
>> @@ -160,11 +161,15 @@ static int populate_ruleset(const char *const env_var, const int ruleset_fd,
>>    	LANDLOCK_ACCESS_FS_MAKE_FIFO | \
>>    	LANDLOCK_ACCESS_FS_MAKE_BLOCK | \
>>    	LANDLOCK_ACCESS_FS_MAKE_SYM | \
>> -	LANDLOCK_ACCESS_FS_REFER)
>> +	LANDLOCK_ACCESS_FS_REFER | \
>> +	LANDLOCK_ACCESS_FS_TRUNCATE)
>>    
>>    #define ACCESS_ABI_2 ( \
>>    	LANDLOCK_ACCESS_FS_REFER)
>>    
>> +#define ACCESS_ABI_3 ( \
>> +	LANDLOCK_ACCESS_FS_TRUNCATE)
>> +
>>    /* clang-format on */
>>    
>>    int main(const int argc, char *const argv[], char *const *const envp)
>> @@ -226,6 +231,12 @@ int main(const int argc, char *const argv[], char *const *const envp)
>>    		return 1;
>>    	}
>>    	/* Best-effort security. */
>> +	if (abi < 3) {
>> +		ruleset_attr.handled_access_fs &= ~ACCESS_ABI_3;
>> +		access_fs_ro &= ~ACCESS_ABI_3;
>> +		access_fs_rw &= ~ACCESS_ABI_3;
>> +	}
> 
> I think it is a good time to start replacing this "if" check with a
> switch one:
> 
> switch (abi) {
> case 1:
> 	ruleset_attr.handled_access_fs &= ~ACCESS_ABI_2;
> 	access_fs_rw &= ~ACCESS_ABI_2;
> 	__attribute__((fallthrough));
> case 2:
> 	ruleset_attr.handled_access_fs &= ~ACCESS_ABI_3;
> 	access_fs_rw &= ~ACCESS_ABI_3;
> }

Well, we can just mask ruleset_attr.handled_access_fs in this 
switch/case and after mask access_fs_ro and access_fs_rw after.


> 
> 
>> +
>>    	if (abi < 2) {
>>    		ruleset_attr.handled_access_fs &= ~ACCESS_ABI_2;
>>    		access_fs_ro &= ~ACCESS_ABI_2;