[pseudo][PATCH 0/6] Add landlock support, fix seccomp

[Mark Hatle <mark.hatle@kernel.crashing.org>]

The first 3 changes add support for landlock.  This was recently
reported by Richard Tollerton that xz on arch linux was now using
landlock and breaking pseudo invocations.  The first patch is a
test case, second patch moves to using /proc instead of a chdir
(with fallback to prior behavior) and third patch intercepts the
syscall and avoids landlock.  This was implemented as a belt and
suspenders type approach, as there have been instances of similar
software in the past using non-standard ways to activate.

During review and testing, it was observed that the prctl/seccomp
implementation was incomplete.  Add tests, and then fix the
existing implementation.

Mark Hatle (6):
  test-landlock: Add a Landlock sandbox test
  pseudo_client: Connect to the server without changing directory
  ports/linux/pseudo_wrappers: Report Landlock as unsupported
  test-seccomp: Check that seccomp is never really enabled
  ports/linux/pseudo_wrappers: Fake seccomp filters set by prctl()
  ports/linux/pseudo_wrappers: Fake seccomp strict mode in syscall()

 README.security               |  14 ++++
 ports/linux/pseudo_wrappers.c |  29 +++++++--
 pseudo_client.c               |  77 +++++++++++++++-------
 test/test-landlock.c          | 146 ++++++++++++++++++++++++++++++++++++++++++
 test/test-landlock.sh         |  24 +++++++
 test/test-seccomp.c           | 121 ++++++++++++++++++++++++++++++++++
 test/test-seccomp.sh          |  12 ++++
 7 files changed, 395 insertions(+), 28 deletions(-)
 create mode 100644 test/test-landlock.c
 create mode 100755 test/test-landlock.sh
 create mode 100644 test/test-seccomp.c
 create mode 100755 test/test-seccomp.sh

-- 
1.8.3.1