Re: [PATCH v2 3/4] samples/landlock: Extend sample tool to support LANDLOCK_ACCESS_FS_TRUNCATE

["Günther Noack" <gnoack3000@gmail.com>]

On Fri, Jul 29, 2022 at 12:43:47PM +0200, Mickaël Salaün wrote:
>
> On 29/07/2022 12:38, Mickaël Salaün wrote:
> >
> > On 29/07/2022 12:31, Mickaël Salaün wrote:
> > >
> > > On 12/07/2022 23:14, Günther Noack wrote:
> > > > The sample tool will restrict the truncate operation if possible with
> > > > the current kernel.
> > >
> > > "Update the sandboxer sample to restrict truncate actions.  This is
> > > automatically enabled by default if the running kernel supports
> > > LANDLOCK_ACCESS_FS_TRUNCATE, except for the paths listed in the LL_FS_RW
> > > environment variable."

Done.

> > >
> > >
> > > >
> > > > Signed-off-by: Günther Noack <gnoack3000@gmail.com>
> > > > Link: https://lore.kernel.org/all/20220707200612.132705-1-gnoack3000@gmail.com/
> > > > ---
> > > >     samples/landlock/sandboxer.c | 15 +++++++++++++--
> > > >     1 file changed, 13 insertions(+), 2 deletions(-)
> > > >
> > > > diff --git a/samples/landlock/sandboxer.c b/samples/landlock/sandboxer.c
> > > > index 3e404e51ec64..4c3ed0097ffd 100644
> > > > --- a/samples/landlock/sandboxer.c
> > > > +++ b/samples/landlock/sandboxer.c
> > > > @@ -76,7 +76,8 @@ static int parse_path(char *env_path, const char ***const path_list)
> > > >     #define ACCESS_FILE ( \
> > > >     	LANDLOCK_ACCESS_FS_EXECUTE | \
> > > >     	LANDLOCK_ACCESS_FS_WRITE_FILE | \
> > > > -	LANDLOCK_ACCESS_FS_READ_FILE)
> > > > +	LANDLOCK_ACCESS_FS_READ_FILE | \
> > > > +	LANDLOCK_ACCESS_FS_TRUNCATE)
> > > >     /* clang-format on */
> > > > @@ -160,11 +161,15 @@ static int populate_ruleset(const char *const env_var, const int ruleset_fd,
> > > >     	LANDLOCK_ACCESS_FS_MAKE_FIFO | \
> > > >     	LANDLOCK_ACCESS_FS_MAKE_BLOCK | \
> > > >     	LANDLOCK_ACCESS_FS_MAKE_SYM | \
> > > > -	LANDLOCK_ACCESS_FS_REFER)
> > > > +	LANDLOCK_ACCESS_FS_REFER | \
> > > > +	LANDLOCK_ACCESS_FS_TRUNCATE)
> > > >     #define ACCESS_ABI_2 ( \
> > > >     	LANDLOCK_ACCESS_FS_REFER)
> > > > +#define ACCESS_ABI_3 ( \
> > > > +	LANDLOCK_ACCESS_FS_TRUNCATE)
> > > > +
> > > >     /* clang-format on */
> > > >     int main(const int argc, char *const argv[], char *const *const envp)
> > > > @@ -226,6 +231,12 @@ int main(const int argc, char *const argv[], char *const *const envp)
> > > >     		return 1;
> > > >     	}
> > > >     	/* Best-effort security. */
> > > > +	if (abi < 3) {
> > > > +		ruleset_attr.handled_access_fs &= ~ACCESS_ABI_3;
> > > > +		access_fs_ro &= ~ACCESS_ABI_3;
> > > > +		access_fs_rw &= ~ACCESS_ABI_3;
> > > > +	}
> > >
> > > I think it is a good time to start replacing this "if" check with a
> > > switch one:
> > >
> > > switch (abi) {
> > > case 1:
> > > 	ruleset_attr.handled_access_fs &= ~ACCESS_ABI_2;
> > > 	access_fs_rw &= ~ACCESS_ABI_2;
> > > 	__attribute__((fallthrough));
> > > case 2:
> > > 	ruleset_attr.handled_access_fs &= ~ACCESS_ABI_3;
> > > 	access_fs_rw &= ~ACCESS_ABI_3;
> > > }
> >
> > Well, we can just mask ruleset_attr.handled_access_fs in this
> > switch/case and after mask access_fs_ro and access_fs_rw after.
>
> In fact, we can remove ACCESS_ABI_2 and ACCESS_ABI_3 (which are only used
> here).

Done (all three).

--