diff options
author | 2022-09-04 10:51:26 -0400 | |
---|---|---|
committer | 2022-09-04 10:51:26 -0400 | |
commit | c5a052ffa4e2ccaf240635db116a49986808a2b6 (patch) | |
tree | 14a9e860dc00cbb16cd6ec14602e4709c63caba8 | |
parent | fix syntax in configure.ac (diff) | |
download | firejail-c5a052ffa4e2ccaf240635db116a49986808a2b6.tar.gz firejail-c5a052ffa4e2ccaf240635db116a49986808a2b6.tar.zst firejail-c5a052ffa4e2ccaf240635db116a49986808a2b6.zip |
landlock: check for landlock support in glibc
-rw-r--r-- | README.md | 40 | ||||
-rw-r--r-- | RELNOTES | 1 | ||||
-rwxr-xr-x | configure | 692 | ||||
-rw-r--r-- | configure.ac | 1 |
4 files changed, 392 insertions, 342 deletions
@@ -270,6 +270,46 @@ Work in progress, the interface described in the man page below could change. | |||
270 | Example: | 270 | Example: |
271 | $ firejail --landlock.read=/ --landlock.write=/home --land‐ | 271 | $ firejail --landlock.read=/ --landlock.write=/home --land‐ |
272 | lock.execute=/usr | 272 | lock.execute=/usr |
273 | |||
274 | LANDLOCK | ||
275 | Landlock is a Linux security module first introduced in the 5.13 ver‐ | ||
276 | sion of Linux kernel. It allows unprivileged processes to restrict | ||
277 | their access to the filesystem. Once imposed, these restrictions can | ||
278 | never be removed, and all child processes created by a Landlock-re‐ | ||
279 | stricted processes inherit these restrictions. Firejail supports Land‐ | ||
280 | lock as an additional sandboxing feature. It can be used to ensure that | ||
281 | a sandboxed application can only access files and directories that it | ||
282 | was explicitly allowed to access. Firejail supports populating the | ||
283 | ruleset with both basic set of rules and with custom set of rules. Ba‐ | ||
284 | sic set of rules allows read-only access to /bin, /dev, /etc, /lib, | ||
285 | /opt, /proc, /usr and /var, read-write access to the home directory, | ||
286 | and allows execution of binaries located in /bin, /opt and /usr. | ||
287 | |||
288 | Important notes: | ||
289 | |||
290 | - A process can install a Landlock ruleset only if it has either | ||
291 | CAP_SYS_ADMIN in its effective capability set, or the "No New | ||
292 | Privileges" restriction enabled. Because of this, enabling the | ||
293 | Landlock feature will also cause Firejail to enable the "No New | ||
294 | Privileges" restriction, regardless of the profile or the | ||
295 | --no-new-privs command line option. | ||
296 | |||
297 | - Access to the /proc directory is managed through the --land‐ | ||
298 | lock.proc command line option. | ||
299 | |||
300 | - Access to the /etc directory is automatically allowed. To | ||
301 | override this, use the --writable-etc command line option. You | ||
302 | can also use the --private-etc option to restrict access to the | ||
303 | /etc directory. | ||
304 | |||
305 | To enable Landlock self-restriction on top of your current Firejail se‐ | ||
306 | curity features, pass --landlock flag to Firejail command line. You can | ||
307 | also use --landlock.read, --landlock.write, --landlock.special and | ||
308 | --landlock.execute options together with --landlock or instead of it. | ||
309 | Example: | ||
310 | |||
311 | $ firejail --landlock --landlock.read=/media --landlock.proc=ro | ||
312 | mc | ||
273 | ````` | 313 | ````` |
274 | 314 | ||
275 | ### Profile Statistics | 315 | ### Profile Statistics |
@@ -16,6 +16,7 @@ firejail (0.9.71) baseline; urgency=low | |||
16 | a seccomp filter for both 64 and 32 bit architectures (#4939 #5259) | 16 | a seccomp filter for both 64 and 32 bit architectures (#4939 #5259) |
17 | * feature: support for custom AppArmor profiles (--apparmor=) (#5274 #5316 | 17 | * feature: support for custom AppArmor profiles (--apparmor=) (#5274 #5316 |
18 | #5317) | 18 | #5317) |
19 | * feature: Landlock support (#5269) | ||
19 | * bugfix: Flood of seccomp audit log entries (#5207) | 20 | * bugfix: Flood of seccomp audit log entries (#5207) |
20 | * build: deduplicate configure-time vars into new config files (#5140 #5284) | 21 | * build: deduplicate configure-time vars into new config files (#5140 #5284) |
21 | * build: fix file mode of shell scripts (644 -> 755) (#5206) | 22 | * build: fix file mode of shell scripts (644 -> 755) (#5206) |
@@ -624,9 +624,6 @@ ac_includes_default="\ | |||
624 | 624 | ||
625 | ac_subst_vars='LTLIBOBJS | 625 | ac_subst_vars='LTLIBOBJS |
626 | LIBOBJS | 626 | LIBOBJS |
627 | EGREP | ||
628 | GREP | ||
629 | CPP | ||
630 | HAVE_LTS | 627 | HAVE_LTS |
631 | HAVE_ONLY_SYSCFG_PROFILES | 628 | HAVE_ONLY_SYSCFG_PROFILES |
632 | HAVE_FORCE_NONEWPRIVS | 629 | HAVE_FORCE_NONEWPRIVS |
@@ -651,8 +648,11 @@ HAVE_OVERLAYFS | |||
651 | HAVE_DBUSPROXY | 648 | HAVE_DBUSPROXY |
652 | EXTRA_LDFLAGS | 649 | EXTRA_LDFLAGS |
653 | EXTRA_CFLAGS | 650 | EXTRA_CFLAGS |
654 | HAVE_SELINUX | 651 | EGREP |
652 | GREP | ||
653 | CPP | ||
655 | HAVE_LANDLOCK | 654 | HAVE_LANDLOCK |
655 | HAVE_SELINUX | ||
656 | AA_LIBS | 656 | AA_LIBS |
657 | AA_CFLAGS | 657 | AA_CFLAGS |
658 | PKG_CONFIG_LIBDIR | 658 | PKG_CONFIG_LIBDIR |
@@ -3352,343 +3352,6 @@ if test "${enable_landlock+set}" = set; then : | |||
3352 | enableval=$enable_landlock; | 3352 | enableval=$enable_landlock; |
3353 | fi | 3353 | fi |
3354 | 3354 | ||
3355 | if test "x$enable_landlock" = "xyes"; then : | ||
3356 | |||
3357 | HAVE_LANDLOCK="-DHAVE_LANDLOCK" | ||
3358 | EXTRA_LDFLAGS="$EXTRA_LDFLAGS" | ||
3359 | |||
3360 | fi | ||
3361 | |||
3362 | |||
3363 | |||
3364 | HAVE_DBUSPROXY="" | ||
3365 | |||
3366 | # Check whether --enable-dbusproxy was given. | ||
3367 | if test "${enable_dbusproxy+set}" = set; then : | ||
3368 | enableval=$enable_dbusproxy; | ||
3369 | fi | ||
3370 | |||
3371 | if test "x$enable_dbusproxy" != "xno"; then : | ||
3372 | |||
3373 | HAVE_DBUSPROXY="-DHAVE_DBUSPROXY" | ||
3374 | |||
3375 | fi | ||
3376 | |||
3377 | # overlayfs features temporarily disabled pending fixes | ||
3378 | HAVE_OVERLAYFS="" | ||
3379 | |||
3380 | #AC_ARG_ENABLE([overlayfs], | ||
3381 | # [AS_HELP_STRING([--disable-overlayfs], [disable overlayfs])]) | ||
3382 | #AS_IF([test "x$enable_overlayfs" != "xno"], [ | ||
3383 | # HAVE_OVERLAYFS="-DHAVE_OVERLAYFS" | ||
3384 | #]) | ||
3385 | |||
3386 | HAVE_OUTPUT="" | ||
3387 | |||
3388 | # Check whether --enable-output was given. | ||
3389 | if test "${enable_output+set}" = set; then : | ||
3390 | enableval=$enable_output; | ||
3391 | fi | ||
3392 | |||
3393 | if test "x$enable_output" != "xno"; then : | ||
3394 | |||
3395 | HAVE_OUTPUT="-DHAVE_OUTPUT" | ||
3396 | |||
3397 | fi | ||
3398 | |||
3399 | HAVE_USERTMPFS="" | ||
3400 | |||
3401 | # Check whether --enable-usertmpfs was given. | ||
3402 | if test "${enable_usertmpfs+set}" = set; then : | ||
3403 | enableval=$enable_usertmpfs; | ||
3404 | fi | ||
3405 | |||
3406 | if test "x$enable_usertmpfs" != "xno"; then : | ||
3407 | |||
3408 | HAVE_USERTMPFS="-DHAVE_USERTMPFS" | ||
3409 | |||
3410 | fi | ||
3411 | |||
3412 | HAVE_MAN="no" | ||
3413 | |||
3414 | # Check whether --enable-man was given. | ||
3415 | if test "${enable_man+set}" = set; then : | ||
3416 | enableval=$enable_man; | ||
3417 | fi | ||
3418 | |||
3419 | if test "x$enable_man" != "xno"; then : | ||
3420 | |||
3421 | HAVE_MAN="-DHAVE_MAN" | ||
3422 | # Extract the first word of "gawk", so it can be a program name with args. | ||
3423 | set dummy gawk; ac_word=$2 | ||
3424 | { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 | ||
3425 | $as_echo_n "checking for $ac_word... " >&6; } | ||
3426 | if ${ac_cv_prog_HAVE_GAWK+:} false; then : | ||
3427 | $as_echo_n "(cached) " >&6 | ||
3428 | else | ||
3429 | if test -n "$HAVE_GAWK"; then | ||
3430 | ac_cv_prog_HAVE_GAWK="$HAVE_GAWK" # Let the user override the test. | ||
3431 | else | ||
3432 | as_save_IFS=$IFS; IFS=$PATH_SEPARATOR | ||
3433 | for as_dir in $PATH | ||
3434 | do | ||
3435 | IFS=$as_save_IFS | ||
3436 | test -z "$as_dir" && as_dir=. | ||
3437 | for ac_exec_ext in '' $ac_executable_extensions; do | ||
3438 | if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then | ||
3439 | ac_cv_prog_HAVE_GAWK="yes" | ||
3440 | $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 | ||
3441 | break 2 | ||
3442 | fi | ||
3443 | done | ||
3444 | done | ||
3445 | IFS=$as_save_IFS | ||
3446 | |||
3447 | test -z "$ac_cv_prog_HAVE_GAWK" && ac_cv_prog_HAVE_GAWK="no" | ||
3448 | fi | ||
3449 | fi | ||
3450 | HAVE_GAWK=$ac_cv_prog_HAVE_GAWK | ||
3451 | if test -n "$HAVE_GAWK"; then | ||
3452 | { $as_echo "$as_me:${as_lineno-$LINENO}: result: $HAVE_GAWK" >&5 | ||
3453 | $as_echo "$HAVE_GAWK" >&6; } | ||
3454 | else | ||
3455 | { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 | ||
3456 | $as_echo "no" >&6; } | ||
3457 | fi | ||
3458 | |||
3459 | |||
3460 | if test "x$HAVE_GAWK" != "xyes"; then : | ||
3461 | as_fn_error $? "*** gawk not found ***" "$LINENO" 5 | ||
3462 | fi | ||
3463 | |||
3464 | fi | ||
3465 | |||
3466 | HAVE_FIRETUNNEL="" | ||
3467 | |||
3468 | # Check whether --enable-firetunnel was given. | ||
3469 | if test "${enable_firetunnel+set}" = set; then : | ||
3470 | enableval=$enable_firetunnel; | ||
3471 | fi | ||
3472 | |||
3473 | if test "x$enable_firetunnel" = "xyes"; then : | ||
3474 | |||
3475 | HAVE_FIRETUNNEL="-DHAVE_FIRETUNNEL" | ||
3476 | |||
3477 | fi | ||
3478 | |||
3479 | HAVE_PRIVATE_HOME="" | ||
3480 | |||
3481 | # Check whether --enable-private-home was given. | ||
3482 | if test "${enable_private_home+set}" = set; then : | ||
3483 | enableval=$enable_private_home; | ||
3484 | fi | ||
3485 | |||
3486 | if test "x$enable_private_home" != "xno"; then : | ||
3487 | |||
3488 | HAVE_PRIVATE_HOME="-DHAVE_PRIVATE_HOME" | ||
3489 | |||
3490 | fi | ||
3491 | |||
3492 | HAVE_CHROOT="" | ||
3493 | |||
3494 | # Check whether --enable-chroot was given. | ||
3495 | if test "${enable_chroot+set}" = set; then : | ||
3496 | enableval=$enable_chroot; | ||
3497 | fi | ||
3498 | |||
3499 | if test "x$enable_chroot" != "xno"; then : | ||
3500 | |||
3501 | HAVE_CHROOT="-DHAVE_CHROOT" | ||
3502 | |||
3503 | fi | ||
3504 | |||
3505 | HAVE_GLOBALCFG="" | ||
3506 | |||
3507 | # Check whether --enable-globalcfg was given. | ||
3508 | if test "${enable_globalcfg+set}" = set; then : | ||
3509 | enableval=$enable_globalcfg; | ||
3510 | fi | ||
3511 | |||
3512 | if test "x$enable_globalcfg" != "xno"; then : | ||
3513 | |||
3514 | HAVE_GLOBALCFG="-DHAVE_GLOBALCFG" | ||
3515 | |||
3516 | fi | ||
3517 | |||
3518 | HAVE_NETWORK="" | ||
3519 | |||
3520 | # Check whether --enable-network was given. | ||
3521 | if test "${enable_network+set}" = set; then : | ||
3522 | enableval=$enable_network; | ||
3523 | fi | ||
3524 | |||
3525 | if test "x$enable_network" != "xno"; then : | ||
3526 | |||
3527 | HAVE_NETWORK="-DHAVE_NETWORK" | ||
3528 | |||
3529 | fi | ||
3530 | |||
3531 | HAVE_USERNS="" | ||
3532 | |||
3533 | # Check whether --enable-userns was given. | ||
3534 | if test "${enable_userns+set}" = set; then : | ||
3535 | enableval=$enable_userns; | ||
3536 | fi | ||
3537 | |||
3538 | if test "x$enable_userns" != "xno"; then : | ||
3539 | |||
3540 | HAVE_USERNS="-DHAVE_USERNS" | ||
3541 | |||
3542 | fi | ||
3543 | |||
3544 | HAVE_X11="" | ||
3545 | |||
3546 | # Check whether --enable-x11 was given. | ||
3547 | if test "${enable_x11+set}" = set; then : | ||
3548 | enableval=$enable_x11; | ||
3549 | fi | ||
3550 | |||
3551 | if test "x$enable_x11" != "xno"; then : | ||
3552 | |||
3553 | HAVE_X11="-DHAVE_X11" | ||
3554 | |||
3555 | fi | ||
3556 | |||
3557 | HAVE_FILE_TRANSFER="" | ||
3558 | |||
3559 | # Check whether --enable-file-transfer was given. | ||
3560 | if test "${enable_file_transfer+set}" = set; then : | ||
3561 | enableval=$enable_file_transfer; | ||
3562 | fi | ||
3563 | |||
3564 | if test "x$enable_file_transfer" != "xno"; then : | ||
3565 | |||
3566 | HAVE_FILE_TRANSFER="-DHAVE_FILE_TRANSFER" | ||
3567 | |||
3568 | fi | ||
3569 | |||
3570 | HAVE_SUID="" | ||
3571 | |||
3572 | # Check whether --enable-suid was given. | ||
3573 | if test "${enable_suid+set}" = set; then : | ||
3574 | enableval=$enable_suid; | ||
3575 | fi | ||
3576 | |||
3577 | if test "x$enable_suid" != "xno"; then : | ||
3578 | |||
3579 | HAVE_SUID="-DHAVE_SUID" | ||
3580 | |||
3581 | fi | ||
3582 | |||
3583 | HAVE_FATAL_WARNINGS="" | ||
3584 | |||
3585 | # Check whether --enable-fatal_warnings was given. | ||
3586 | if test "${enable_fatal_warnings+set}" = set; then : | ||
3587 | enableval=$enable_fatal_warnings; | ||
3588 | fi | ||
3589 | |||
3590 | if test "x$enable_fatal_warnings" = "xyes"; then : | ||
3591 | |||
3592 | HAVE_FATAL_WARNINGS="-W -Wall -Werror" | ||
3593 | |||
3594 | fi | ||
3595 | |||
3596 | BUSYBOX_WORKAROUND="no" | ||
3597 | |||
3598 | # Check whether --enable-busybox-workaround was given. | ||
3599 | if test "${enable_busybox_workaround+set}" = set; then : | ||
3600 | enableval=$enable_busybox_workaround; | ||
3601 | fi | ||
3602 | |||
3603 | if test "x$enable_busybox_workaround" = "xyes"; then : | ||
3604 | |||
3605 | BUSYBOX_WORKAROUND="yes" | ||
3606 | |||
3607 | fi | ||
3608 | |||
3609 | |||
3610 | HAVE_GCOV="" | ||
3611 | |||
3612 | # Check whether --enable-gcov was given. | ||
3613 | if test "${enable_gcov+set}" = set; then : | ||
3614 | enableval=$enable_gcov; | ||
3615 | fi | ||
3616 | |||
3617 | if test "x$enable_gcov" = "xyes"; then : | ||
3618 | |||
3619 | HAVE_GCOV="--coverage -DHAVE_GCOV" | ||
3620 | EXTRA_LDFLAGS="$EXTRA_LDFLAGS -lgcov --coverage" | ||
3621 | |||
3622 | fi | ||
3623 | |||
3624 | HAVE_CONTRIB_INSTALL="yes" | ||
3625 | |||
3626 | # Check whether --enable-contrib-install was given. | ||
3627 | if test "${enable_contrib_install+set}" = set; then : | ||
3628 | enableval=$enable_contrib_install; | ||
3629 | fi | ||
3630 | |||
3631 | if test "x$enable_contrib_install" = "xno"; then : | ||
3632 | |||
3633 | HAVE_CONTRIB_INSTALL="no" | ||
3634 | |||
3635 | fi | ||
3636 | |||
3637 | HAVE_FORCE_NONEWPRIVS="" | ||
3638 | |||
3639 | # Check whether --enable-force-nonewprivs was given. | ||
3640 | if test "${enable_force_nonewprivs+set}" = set; then : | ||
3641 | enableval=$enable_force_nonewprivs; | ||
3642 | fi | ||
3643 | |||
3644 | if test "x$enable_force_nonewprivs" = "xyes"; then : | ||
3645 | |||
3646 | HAVE_FORCE_NONEWPRIVS="-DHAVE_FORCE_NONEWPRIVS" | ||
3647 | |||
3648 | fi | ||
3649 | |||
3650 | HAVE_ONLY_SYSCFG_PROFILES="" | ||
3651 | |||
3652 | # Check whether --enable-only-syscfg-profiles was given. | ||
3653 | if test "${enable_only_syscfg_profiles+set}" = set; then : | ||
3654 | enableval=$enable_only_syscfg_profiles; | ||
3655 | fi | ||
3656 | |||
3657 | if test "x$enable_only_syscfg_profiles" = "xyes"; then : | ||
3658 | |||
3659 | HAVE_ONLY_SYSCFG_PROFILES="-DHAVE_ONLY_SYSCFG_PROFILES" | ||
3660 | |||
3661 | fi | ||
3662 | |||
3663 | HAVE_LTS="" | ||
3664 | |||
3665 | # Check whether --enable-lts was given. | ||
3666 | if test "${enable_lts+set}" = set; then : | ||
3667 | enableval=$enable_lts; | ||
3668 | fi | ||
3669 | |||
3670 | if test "x$enable_lts" = "xyes"; then : | ||
3671 | |||
3672 | HAVE_LTS="-DHAVE_LTS" | ||
3673 | HAVE_IDS="" | ||
3674 | HAVE_DBUSPROXY="" | ||
3675 | HAVE_OVERLAYFS="" | ||
3676 | HAVE_OUTPUT="" | ||
3677 | HAVE_USERTMPFS="" | ||
3678 | HAVE_MAN="-DHAVE_MAN" | ||
3679 | HAVE_FIRETUNNEL="" | ||
3680 | HAVE_PRIVATE_HOME="" | ||
3681 | HAVE_CHROOT="" | ||
3682 | HAVE_GLOBALCFG="" | ||
3683 | HAVE_USERNS="" | ||
3684 | HAVE_X11="" | ||
3685 | HAVE_FILE_TRANSFER="" | ||
3686 | HAVE_SUID="-DHAVE_SUID" | ||
3687 | BUSYBOX_WORKAROUND="no" | ||
3688 | HAVE_CONTRIB_INSTALL="no", | ||
3689 | |||
3690 | fi | ||
3691 | |||
3692 | ac_ext=c | 3355 | ac_ext=c |
3693 | ac_cpp='$CPP $CPPFLAGS' | 3356 | ac_cpp='$CPP $CPPFLAGS' |
3694 | ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' | 3357 | ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' |
@@ -4086,6 +3749,352 @@ fi | |||
4086 | done | 3749 | done |
4087 | 3750 | ||
4088 | 3751 | ||
3752 | if test "x$enable_landlock" = "xyes"; then : | ||
3753 | |||
3754 | ac_fn_c_check_header_mongrel "$LINENO" "linux/landlock.h" "ac_cv_header_linux_landlock_h" "$ac_includes_default" | ||
3755 | if test "x$ac_cv_header_linux_landlock_h" = xyes; then : | ||
3756 | |||
3757 | else | ||
3758 | as_fn_error $? "*** LANDLOCK support is not installed (/usr/include/linux/landlock.h missing) ***" "$LINENO" 5 | ||
3759 | fi | ||
3760 | |||
3761 | |||
3762 | HAVE_LANDLOCK="-DHAVE_LANDLOCK" | ||
3763 | EXTRA_LDFLAGS="$EXTRA_LDFLAGS" | ||
3764 | |||
3765 | fi | ||
3766 | |||
3767 | |||
3768 | |||
3769 | |||
3770 | HAVE_DBUSPROXY="" | ||
3771 | |||
3772 | # Check whether --enable-dbusproxy was given. | ||
3773 | if test "${enable_dbusproxy+set}" = set; then : | ||
3774 | enableval=$enable_dbusproxy; | ||
3775 | fi | ||
3776 | |||
3777 | if test "x$enable_dbusproxy" != "xno"; then : | ||
3778 | |||
3779 | HAVE_DBUSPROXY="-DHAVE_DBUSPROXY" | ||
3780 | |||
3781 | fi | ||
3782 | |||
3783 | # overlayfs features temporarily disabled pending fixes | ||
3784 | HAVE_OVERLAYFS="" | ||
3785 | |||
3786 | #AC_ARG_ENABLE([overlayfs], | ||
3787 | # [AS_HELP_STRING([--disable-overlayfs], [disable overlayfs])]) | ||
3788 | #AS_IF([test "x$enable_overlayfs" != "xno"], [ | ||
3789 | # HAVE_OVERLAYFS="-DHAVE_OVERLAYFS" | ||
3790 | #]) | ||
3791 | |||
3792 | HAVE_OUTPUT="" | ||
3793 | |||
3794 | # Check whether --enable-output was given. | ||
3795 | if test "${enable_output+set}" = set; then : | ||
3796 | enableval=$enable_output; | ||
3797 | fi | ||
3798 | |||
3799 | if test "x$enable_output" != "xno"; then : | ||
3800 | |||
3801 | HAVE_OUTPUT="-DHAVE_OUTPUT" | ||
3802 | |||
3803 | fi | ||
3804 | |||
3805 | HAVE_USERTMPFS="" | ||
3806 | |||
3807 | # Check whether --enable-usertmpfs was given. | ||
3808 | if test "${enable_usertmpfs+set}" = set; then : | ||
3809 | enableval=$enable_usertmpfs; | ||
3810 | fi | ||
3811 | |||
3812 | if test "x$enable_usertmpfs" != "xno"; then : | ||
3813 | |||
3814 | HAVE_USERTMPFS="-DHAVE_USERTMPFS" | ||
3815 | |||
3816 | fi | ||
3817 | |||
3818 | HAVE_MAN="no" | ||
3819 | |||
3820 | # Check whether --enable-man was given. | ||
3821 | if test "${enable_man+set}" = set; then : | ||
3822 | enableval=$enable_man; | ||
3823 | fi | ||
3824 | |||
3825 | if test "x$enable_man" != "xno"; then : | ||
3826 | |||
3827 | HAVE_MAN="-DHAVE_MAN" | ||
3828 | # Extract the first word of "gawk", so it can be a program name with args. | ||
3829 | set dummy gawk; ac_word=$2 | ||
3830 | { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 | ||
3831 | $as_echo_n "checking for $ac_word... " >&6; } | ||
3832 | if ${ac_cv_prog_HAVE_GAWK+:} false; then : | ||
3833 | $as_echo_n "(cached) " >&6 | ||
3834 | else | ||
3835 | if test -n "$HAVE_GAWK"; then | ||
3836 | ac_cv_prog_HAVE_GAWK="$HAVE_GAWK" # Let the user override the test. | ||
3837 | else | ||
3838 | as_save_IFS=$IFS; IFS=$PATH_SEPARATOR | ||
3839 | for as_dir in $PATH | ||
3840 | do | ||
3841 | IFS=$as_save_IFS | ||
3842 | test -z "$as_dir" && as_dir=. | ||
3843 | for ac_exec_ext in '' $ac_executable_extensions; do | ||
3844 | if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then | ||
3845 | ac_cv_prog_HAVE_GAWK="yes" | ||
3846 | $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 | ||
3847 | break 2 | ||
3848 | fi | ||
3849 | done | ||
3850 | done | ||
3851 | IFS=$as_save_IFS | ||
3852 | |||
3853 | test -z "$ac_cv_prog_HAVE_GAWK" && ac_cv_prog_HAVE_GAWK="no" | ||
3854 | fi | ||
3855 | fi | ||
3856 | HAVE_GAWK=$ac_cv_prog_HAVE_GAWK | ||
3857 | if test -n "$HAVE_GAWK"; then | ||
3858 | { $as_echo "$as_me:${as_lineno-$LINENO}: result: $HAVE_GAWK" >&5 | ||
3859 | $as_echo "$HAVE_GAWK" >&6; } | ||
3860 | else | ||
3861 | { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 | ||
3862 | $as_echo "no" >&6; } | ||
3863 | fi | ||
3864 | |||
3865 | |||
3866 | if test "x$HAVE_GAWK" != "xyes"; then : | ||
3867 | as_fn_error $? "*** gawk not found ***" "$LINENO" 5 | ||
3868 | fi | ||
3869 | |||
3870 | fi | ||
3871 | |||
3872 | HAVE_FIRETUNNEL="" | ||
3873 | |||
3874 | # Check whether --enable-firetunnel was given. | ||
3875 | if test "${enable_firetunnel+set}" = set; then : | ||
3876 | enableval=$enable_firetunnel; | ||
3877 | fi | ||
3878 | |||
3879 | if test "x$enable_firetunnel" = "xyes"; then : | ||
3880 | |||
3881 | HAVE_FIRETUNNEL="-DHAVE_FIRETUNNEL" | ||
3882 | |||
3883 | fi | ||
3884 | |||
3885 | HAVE_PRIVATE_HOME="" | ||
3886 | |||
3887 | # Check whether --enable-private-home was given. | ||
3888 | if test "${enable_private_home+set}" = set; then : | ||
3889 | enableval=$enable_private_home; | ||
3890 | fi | ||
3891 | |||
3892 | if test "x$enable_private_home" != "xno"; then : | ||
3893 | |||
3894 | HAVE_PRIVATE_HOME="-DHAVE_PRIVATE_HOME" | ||
3895 | |||
3896 | fi | ||
3897 | |||
3898 | HAVE_CHROOT="" | ||
3899 | |||
3900 | # Check whether --enable-chroot was given. | ||
3901 | if test "${enable_chroot+set}" = set; then : | ||
3902 | enableval=$enable_chroot; | ||
3903 | fi | ||
3904 | |||
3905 | if test "x$enable_chroot" != "xno"; then : | ||
3906 | |||
3907 | HAVE_CHROOT="-DHAVE_CHROOT" | ||
3908 | |||
3909 | fi | ||
3910 | |||
3911 | HAVE_GLOBALCFG="" | ||
3912 | |||
3913 | # Check whether --enable-globalcfg was given. | ||
3914 | if test "${enable_globalcfg+set}" = set; then : | ||
3915 | enableval=$enable_globalcfg; | ||
3916 | fi | ||
3917 | |||
3918 | if test "x$enable_globalcfg" != "xno"; then : | ||
3919 | |||
3920 | HAVE_GLOBALCFG="-DHAVE_GLOBALCFG" | ||
3921 | |||
3922 | fi | ||
3923 | |||
3924 | HAVE_NETWORK="" | ||
3925 | |||
3926 | # Check whether --enable-network was given. | ||
3927 | if test "${enable_network+set}" = set; then : | ||
3928 | enableval=$enable_network; | ||
3929 | fi | ||
3930 | |||
3931 | if test "x$enable_network" != "xno"; then : | ||
3932 | |||
3933 | HAVE_NETWORK="-DHAVE_NETWORK" | ||
3934 | |||
3935 | fi | ||
3936 | |||
3937 | HAVE_USERNS="" | ||
3938 | |||
3939 | # Check whether --enable-userns was given. | ||
3940 | if test "${enable_userns+set}" = set; then : | ||
3941 | enableval=$enable_userns; | ||
3942 | fi | ||
3943 | |||
3944 | if test "x$enable_userns" != "xno"; then : | ||
3945 | |||
3946 | HAVE_USERNS="-DHAVE_USERNS" | ||
3947 | |||
3948 | fi | ||
3949 | |||
3950 | HAVE_X11="" | ||
3951 | |||
3952 | # Check whether --enable-x11 was given. | ||
3953 | if test "${enable_x11+set}" = set; then : | ||
3954 | enableval=$enable_x11; | ||
3955 | fi | ||
3956 | |||
3957 | if test "x$enable_x11" != "xno"; then : | ||
3958 | |||
3959 | HAVE_X11="-DHAVE_X11" | ||
3960 | |||
3961 | fi | ||
3962 | |||
3963 | HAVE_FILE_TRANSFER="" | ||
3964 | |||
3965 | # Check whether --enable-file-transfer was given. | ||
3966 | if test "${enable_file_transfer+set}" = set; then : | ||
3967 | enableval=$enable_file_transfer; | ||
3968 | fi | ||
3969 | |||
3970 | if test "x$enable_file_transfer" != "xno"; then : | ||
3971 | |||
3972 | HAVE_FILE_TRANSFER="-DHAVE_FILE_TRANSFER" | ||
3973 | |||
3974 | fi | ||
3975 | |||
3976 | HAVE_SUID="" | ||
3977 | |||
3978 | # Check whether --enable-suid was given. | ||
3979 | if test "${enable_suid+set}" = set; then : | ||
3980 | enableval=$enable_suid; | ||
3981 | fi | ||
3982 | |||
3983 | if test "x$enable_suid" != "xno"; then : | ||
3984 | |||
3985 | HAVE_SUID="-DHAVE_SUID" | ||
3986 | |||
3987 | fi | ||
3988 | |||
3989 | HAVE_FATAL_WARNINGS="" | ||
3990 | |||
3991 | # Check whether --enable-fatal_warnings was given. | ||
3992 | if test "${enable_fatal_warnings+set}" = set; then : | ||
3993 | enableval=$enable_fatal_warnings; | ||
3994 | fi | ||
3995 | |||
3996 | if test "x$enable_fatal_warnings" = "xyes"; then : | ||
3997 | |||
3998 | HAVE_FATAL_WARNINGS="-W -Wall -Werror" | ||
3999 | |||
4000 | fi | ||
4001 | |||
4002 | BUSYBOX_WORKAROUND="no" | ||
4003 | |||
4004 | # Check whether --enable-busybox-workaround was given. | ||
4005 | if test "${enable_busybox_workaround+set}" = set; then : | ||
4006 | enableval=$enable_busybox_workaround; | ||
4007 | fi | ||
4008 | |||
4009 | if test "x$enable_busybox_workaround" = "xyes"; then : | ||
4010 | |||
4011 | BUSYBOX_WORKAROUND="yes" | ||
4012 | |||
4013 | fi | ||
4014 | |||
4015 | |||
4016 | HAVE_GCOV="" | ||
4017 | |||
4018 | # Check whether --enable-gcov was given. | ||
4019 | if test "${enable_gcov+set}" = set; then : | ||
4020 | enableval=$enable_gcov; | ||
4021 | fi | ||
4022 | |||
4023 | if test "x$enable_gcov" = "xyes"; then : | ||
4024 | |||
4025 | HAVE_GCOV="--coverage -DHAVE_GCOV" | ||
4026 | EXTRA_LDFLAGS="$EXTRA_LDFLAGS -lgcov --coverage" | ||
4027 | |||
4028 | fi | ||
4029 | |||
4030 | HAVE_CONTRIB_INSTALL="yes" | ||
4031 | |||
4032 | # Check whether --enable-contrib-install was given. | ||
4033 | if test "${enable_contrib_install+set}" = set; then : | ||
4034 | enableval=$enable_contrib_install; | ||
4035 | fi | ||
4036 | |||
4037 | if test "x$enable_contrib_install" = "xno"; then : | ||
4038 | |||
4039 | HAVE_CONTRIB_INSTALL="no" | ||
4040 | |||
4041 | fi | ||
4042 | |||
4043 | HAVE_FORCE_NONEWPRIVS="" | ||
4044 | |||
4045 | # Check whether --enable-force-nonewprivs was given. | ||
4046 | if test "${enable_force_nonewprivs+set}" = set; then : | ||
4047 | enableval=$enable_force_nonewprivs; | ||
4048 | fi | ||
4049 | |||
4050 | if test "x$enable_force_nonewprivs" = "xyes"; then : | ||
4051 | |||
4052 | HAVE_FORCE_NONEWPRIVS="-DHAVE_FORCE_NONEWPRIVS" | ||
4053 | |||
4054 | fi | ||
4055 | |||
4056 | HAVE_ONLY_SYSCFG_PROFILES="" | ||
4057 | |||
4058 | # Check whether --enable-only-syscfg-profiles was given. | ||
4059 | if test "${enable_only_syscfg_profiles+set}" = set; then : | ||
4060 | enableval=$enable_only_syscfg_profiles; | ||
4061 | fi | ||
4062 | |||
4063 | if test "x$enable_only_syscfg_profiles" = "xyes"; then : | ||
4064 | |||
4065 | HAVE_ONLY_SYSCFG_PROFILES="-DHAVE_ONLY_SYSCFG_PROFILES" | ||
4066 | |||
4067 | fi | ||
4068 | |||
4069 | HAVE_LTS="" | ||
4070 | |||
4071 | # Check whether --enable-lts was given. | ||
4072 | if test "${enable_lts+set}" = set; then : | ||
4073 | enableval=$enable_lts; | ||
4074 | fi | ||
4075 | |||
4076 | if test "x$enable_lts" = "xyes"; then : | ||
4077 | |||
4078 | HAVE_LTS="-DHAVE_LTS" | ||
4079 | HAVE_IDS="" | ||
4080 | HAVE_DBUSPROXY="" | ||
4081 | HAVE_OVERLAYFS="" | ||
4082 | HAVE_OUTPUT="" | ||
4083 | HAVE_USERTMPFS="" | ||
4084 | HAVE_MAN="-DHAVE_MAN" | ||
4085 | HAVE_FIRETUNNEL="" | ||
4086 | HAVE_PRIVATE_HOME="" | ||
4087 | HAVE_CHROOT="" | ||
4088 | HAVE_GLOBALCFG="" | ||
4089 | HAVE_USERNS="" | ||
4090 | HAVE_X11="" | ||
4091 | HAVE_FILE_TRANSFER="" | ||
4092 | HAVE_SUID="-DHAVE_SUID" | ||
4093 | BUSYBOX_WORKAROUND="no" | ||
4094 | HAVE_CONTRIB_INSTALL="no", | ||
4095 | |||
4096 | fi | ||
4097 | |||
4089 | ac_fn_c_check_header_mongrel "$LINENO" "linux/seccomp.h" "ac_cv_header_linux_seccomp_h" "$ac_includes_default" | 4098 | ac_fn_c_check_header_mongrel "$LINENO" "linux/seccomp.h" "ac_cv_header_linux_seccomp_h" "$ac_includes_default" |
4090 | if test "x$ac_cv_header_linux_seccomp_h" = xyes; then : | 4099 | if test "x$ac_cv_header_linux_seccomp_h" = xyes; then : |
4091 | 4100 | ||
@@ -5292,7 +5301,6 @@ Features: | |||
5292 | overlayfs support: $HAVE_OVERLAYFS | 5301 | overlayfs support: $HAVE_OVERLAYFS |
5293 | private home support: $HAVE_PRIVATE_HOME | 5302 | private home support: $HAVE_PRIVATE_HOME |
5294 | SELinux labeling support: $HAVE_SELINUX | 5303 | SELinux labeling support: $HAVE_SELINUX |
5295 | Landlock self-restriction support: $HAVE_LANDLOCK | ||
5296 | user namespace: $HAVE_USERNS | 5304 | user namespace: $HAVE_USERNS |
5297 | X11 sandboxing support: $HAVE_X11 | 5305 | X11 sandboxing support: $HAVE_X11 |
5298 | 5306 | ||
diff --git a/configure.ac b/configure.ac index e06d212ce..58a399597 100644 --- a/configure.ac +++ b/configure.ac | |||
@@ -86,6 +86,7 @@ AC_SUBST([HAVE_LANDLOCK]) | |||
86 | AC_ARG_ENABLE([landlock], | 86 | AC_ARG_ENABLE([landlock], |
87 | [AS_HELP_STRING([--enable-landlock], [Landlock self-restriction support])]) | 87 | [AS_HELP_STRING([--enable-landlock], [Landlock self-restriction support])]) |
88 | AS_IF([test "x$enable_landlock" = "xyes"], [ | 88 | AS_IF([test "x$enable_landlock" = "xyes"], [ |
89 | AC_CHECK_HEADER([linux/landlock.h], [], AC_MSG_ERROR([*** LANDLOCK support is not installed (/usr/include/linux/landlock.h missing) ***])) | ||
89 | HAVE_LANDLOCK="-DHAVE_LANDLOCK" | 90 | HAVE_LANDLOCK="-DHAVE_LANDLOCK" |
90 | EXTRA_LDFLAGS="$EXTRA_LDFLAGS" | 91 | EXTRA_LDFLAGS="$EXTRA_LDFLAGS" |
91 | ]) | 92 | ]) |