[PATCH v2 3/4] samples/landlock: Extend sample tool to support LANDLOCK_ACCESS_FS_TRUNCATE

["Günther Noack" <gnoack3000@gmail.com>]

The sample tool will restrict the truncate operation if possible with
the current kernel.

Signed-off-by: Günther Noack <gnoack3000@gmail.com>
Link: https://lore.kernel.org/all/20220707200612.132705-1-gnoack3000@gmail.com/
---
 samples/landlock/sandboxer.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/samples/landlock/sandboxer.c b/samples/landlock/sandboxer.c
index 3e404e51ec64..4c3ed0097ffd 100644
--- a/samples/landlock/sandboxer.c
+++ b/samples/landlock/sandboxer.c
@@ -76,7 +76,8 @@ static int parse_path(char *env_path, const char ***const path_list)
 #define ACCESS_FILE ( \
 	LANDLOCK_ACCESS_FS_EXECUTE | \
 	LANDLOCK_ACCESS_FS_WRITE_FILE | \
-	LANDLOCK_ACCESS_FS_READ_FILE)
+	LANDLOCK_ACCESS_FS_READ_FILE | \
+	LANDLOCK_ACCESS_FS_TRUNCATE)
 
 /* clang-format on */
 
@@ -160,11 +161,15 @@ static int populate_ruleset(const char *const env_var, const int ruleset_fd,
 	LANDLOCK_ACCESS_FS_MAKE_FIFO | \
 	LANDLOCK_ACCESS_FS_MAKE_BLOCK | \
 	LANDLOCK_ACCESS_FS_MAKE_SYM | \
-	LANDLOCK_ACCESS_FS_REFER)
+	LANDLOCK_ACCESS_FS_REFER | \
+	LANDLOCK_ACCESS_FS_TRUNCATE)
 
 #define ACCESS_ABI_2 ( \
 	LANDLOCK_ACCESS_FS_REFER)
 
+#define ACCESS_ABI_3 ( \
+	LANDLOCK_ACCESS_FS_TRUNCATE)
+
 /* clang-format on */
 
 int main(const int argc, char *const argv[], char *const *const envp)
@@ -226,6 +231,12 @@ int main(const int argc, char *const argv[], char *const *const envp)
 		return 1;
 	}
 	/* Best-effort security. */
+	if (abi < 3) {
+		ruleset_attr.handled_access_fs &= ~ACCESS_ABI_3;
+		access_fs_ro &= ~ACCESS_ABI_3;
+		access_fs_rw &= ~ACCESS_ABI_3;
+	}
+
 	if (abi < 2) {
 		ruleset_attr.handled_access_fs &= ~ACCESS_ABI_2;
 		access_fs_ro &= ~ACCESS_ABI_2;
-- 
2.37.0