[PATCH v2 3/4] samples/landlock: Extend sample tool to support LANDLOCK_ACCESS_FS_TRUNCATE

[Mickaël Salaün]

On 29/07/2022 12:38, Mickaël Salaün wrote:
> 
> On 29/07/2022 12:31, Mickaël Salaün wrote:
>>
>> On 12/07/2022 23:14, Günther Noack wrote:
>>> The sample tool will restrict the truncate operation if possible with
>>> the current kernel.
>>
>> "Update the sandboxer sample to restrict truncate actions.  This is
>> automatically enabled by default if the running kernel supports
>> LANDLOCK_ACCESS_FS_TRUNCATE, except for the paths listed in the LL_FS_RW
>> environment variable."
>>
>>
>>>
>>> Signed-off-by: Günther Noack <gnoack3000 at gmail.com>
>>> Link: https://lore.kernel.org/all/20220707200612.132705-1-gnoack3000@gmail.com/
>>> ---
>>>     samples/landlock/sandboxer.c | 15 +++++++++++++--
>>>     1 file changed, 13 insertions(+), 2 deletions(-)
>>>
>>> diff --git a/samples/landlock/sandboxer.c b/samples/landlock/sandboxer.c
>>> index 3e404e51ec64..4c3ed0097ffd 100644
>>> --- a/samples/landlock/sandboxer.c
>>> +++ b/samples/landlock/sandboxer.c
>>> @@ -76,7 +76,8 @@ static int parse_path(char *env_path, const char ***const path_list)
>>>     #define ACCESS_FILE ( \
>>>     	LANDLOCK_ACCESS_FS_EXECUTE | \
>>>     	LANDLOCK_ACCESS_FS_WRITE_FILE | \
>>> -	LANDLOCK_ACCESS_FS_READ_FILE)
>>> +	LANDLOCK_ACCESS_FS_READ_FILE | \
>>> +	LANDLOCK_ACCESS_FS_TRUNCATE)
>>>     
>>>     /* clang-format on */
>>>     
>>> @@ -160,11 +161,15 @@ static int populate_ruleset(const char *const env_var, const int ruleset_fd,
>>>     	LANDLOCK_ACCESS_FS_MAKE_FIFO | \
>>>     	LANDLOCK_ACCESS_FS_MAKE_BLOCK | \
>>>     	LANDLOCK_ACCESS_FS_MAKE_SYM | \
>>> -	LANDLOCK_ACCESS_FS_REFER)
>>> +	LANDLOCK_ACCESS_FS_REFER | \
>>> +	LANDLOCK_ACCESS_FS_TRUNCATE)
>>>     
>>>     #define ACCESS_ABI_2 ( \
>>>     	LANDLOCK_ACCESS_FS_REFER)
>>>     
>>> +#define ACCESS_ABI_3 ( \
>>> +	LANDLOCK_ACCESS_FS_TRUNCATE)
>>> +
>>>     /* clang-format on */
>>>     
>>>     int main(const int argc, char *const argv[], char *const *const envp)
>>> @@ -226,6 +231,12 @@ int main(const int argc, char *const argv[], char *const *const envp)
>>>     		return 1;
>>>     	}
>>>     	/* Best-effort security. */
>>> +	if (abi < 3) {
>>> +		ruleset_attr.handled_access_fs &= ~ACCESS_ABI_3;
>>> +		access_fs_ro &= ~ACCESS_ABI_3;
>>> +		access_fs_rw &= ~ACCESS_ABI_3;
>>> +	}
>>
>> I think it is a good time to start replacing this "if" check with a
>> switch one:
>>
>> switch (abi) {
>> case 1:
>> 	ruleset_attr.handled_access_fs &= ~ACCESS_ABI_2;
>> 	access_fs_rw &= ~ACCESS_ABI_2;
>> 	__attribute__((fallthrough));
>> case 2:
>> 	ruleset_attr.handled_access_fs &= ~ACCESS_ABI_3;
>> 	access_fs_rw &= ~ACCESS_ABI_3;
>> }
> 
> Well, we can just mask ruleset_attr.handled_access_fs in this
> switch/case and after mask access_fs_ro and access_fs_rw after.

In fact, we can remove ACCESS_ABI_2 and ACCESS_ABI_3 (which are only 
used here).