aboutsummaryrefslogtreecommitdiffstats
path: root/src
diff options
context:
space:
mode:
authorLibravatar Kelvin M. Klann <kmk3.code@protonmail.com>2022-08-29 11:25:34 -0300
committerLibravatar Kelvin M. Klann <kmk3.code@protonmail.com>2022-09-05 01:07:41 -0300
commit97874c3bf923798b0e3ab119d169aaa9b1314221 (patch)
tree469c6f3ecc707becb9472432396910e9874f7b6a /src
parentRevert "compile fix" (diff)
downloadfirejail-97874c3bf923798b0e3ab119d169aaa9b1314221.tar.gz
firejail-97874c3bf923798b0e3ab119d169aaa9b1314221.tar.zst
firejail-97874c3bf923798b0e3ab119d169aaa9b1314221.zip
Revert "Merge pull request #5315 from ChrysoliteAzalea/landlock"
This reverts commit 54cb3e741e972c754e595d56de0bca0792299f83, reversing changes made to 97b1e02d5f4dca4261dc9928f8a5ebf8966682d7. There were many issues and requests for changes raised in the pull request (both code-wise and design-wise) and most of them are still unresolved[1]. [1] https://github.com/netblue30/firejail/pull/5315
Diffstat (limited to 'src')
-rw-r--r--src/bash_completion/firejail.bash_completion.in16
-rw-r--r--src/firejail/firejail.h26
-rw-r--r--src/firejail/landlock.c79
-rw-r--r--src/firejail/main.c81
-rw-r--r--src/firejail/profile.c84
-rw-r--r--src/firejail/sandbox.c27
-rw-r--r--src/firejail/usage.c6
-rw-r--r--src/firejail/util.c4
-rw-r--r--src/man/firejail-profile.txt29
-rw-r--r--src/man/firejail.txt63
-rw-r--r--src/zsh_completion/_firejail.in6
11 files changed, 2 insertions, 419 deletions
diff --git a/src/bash_completion/firejail.bash_completion.in b/src/bash_completion/firejail.bash_completion.in
index 4829f1fde..8e047ce90 100644
--- a/src/bash_completion/firejail.bash_completion.in
+++ b/src/bash_completion/firejail.bash_completion.in
@@ -42,22 +42,6 @@ _firejail()
42 _filedir -d 42 _filedir -d
43 return 0 43 return 0
44 ;; 44 ;;
45 --landlock.read)
46 _filedir
47 return 0
48 ;;
49 --landlock.write)
50 _filedir
51 return 0
52 ;;
53 --landlock.special)
54 _filedir
55 return 0
56 ;;
57 --landlock.execute)
58 _filedir
59 return 0
60 ;;
61 --tmpfs) 45 --tmpfs)
62 _filedir 46 _filedir
63 return 0 47 return 0
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 9c2b53c18..0a4dffb75 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -22,9 +22,6 @@
22#include "../include/common.h" 22#include "../include/common.h"
23#include "../include/euid_common.h" 23#include "../include/euid_common.h"
24#include "../include/rundefs.h" 24#include "../include/rundefs.h"
25#ifdef HAVE_LANDLOCK
26#include <linux/landlock.h>
27#endif
28#include <linux/limits.h> // Note: Plain limits.h may break ARG_MAX (see #4583) 25#include <linux/limits.h> // Note: Plain limits.h may break ARG_MAX (see #4583)
29#include <stdarg.h> 26#include <stdarg.h>
30#include <sys/stat.h> 27#include <sys/stat.h>
@@ -32,25 +29,7 @@
32// debug restricted shell 29// debug restricted shell
33//#define DEBUG_RESTRICTED_SHELL 30//#define DEBUG_RESTRICTED_SHELL
34 31
35#ifdef HAVE_LANDLOCK
36
37extern int landlock_create_ruleset(struct landlock_ruleset_attr *rsattr,size_t size,__u32 flags);
38
39extern int landlock_add_rule(int fd,enum landlock_rule_type t,void *attr,__u32 flags);
40
41extern int landlock_restrict_self(int fd,__u32 flags);
42
43extern int create_full_ruleset();
44
45extern int add_read_access_rule_by_path(int rset_fd,char *allowed_path);
46 32
47extern int add_write_access_rule_by_path(int rset_fd,char *allowed_path);
48
49extern int add_create_special_rule_by_path(int rset_fd,char *allowed_path);
50
51extern int add_execute_rule_by_path(int rset_fd,char *allowed_path);
52
53#endif
54 33
55// profiles 34// profiles
56#define DEFAULT_USER_PROFILE "default" 35#define DEFAULT_USER_PROFILE "default"
@@ -307,11 +286,6 @@ extern int arg_seccomp32; // enable default seccomp filter for 32 bit arch
307extern int arg_seccomp_postexec; // need postexec ld.preload library? 286extern int arg_seccomp_postexec; // need postexec ld.preload library?
308extern int arg_seccomp_block_secondary; // block any secondary architectures 287extern int arg_seccomp_block_secondary; // block any secondary architectures
309 288
310#ifdef HAVE_LANDLOCK
311extern int arg_landlock; // Landlock ruleset file descriptor
312extern int arg_landlock_proc; // Landlock rule for accessing /proc (0 for no access, 1 for read-only and 2 for read-write)
313#endif
314
315extern int arg_caps_default_filter; // enable default capabilities filter 289extern int arg_caps_default_filter; // enable default capabilities filter
316extern int arg_caps_drop; // drop list 290extern int arg_caps_drop; // drop list
317extern int arg_caps_drop_all; // drop all capabilities 291extern int arg_caps_drop_all; // drop all capabilities
diff --git a/src/firejail/landlock.c b/src/firejail/landlock.c
deleted file mode 100644
index 67e2b2cfc..000000000
--- a/src/firejail/landlock.c
+++ /dev/null
@@ -1,79 +0,0 @@
1#define _GNU_SOURCE
2#include <stdio.h>
3#include <stddef.h>
4#include <stdlib.h>
5#include <unistd.h>
6#include <fcntl.h>
7#include <sys/syscall.h>
8#include <sys/types.h>
9#include <sys/prctl.h>
10#include <linux/prctl.h>
11#include <linux/landlock.h>
12
13int landlock_create_ruleset(struct landlock_ruleset_attr *rsattr,size_t size,__u32 flags) {
14 return syscall(__NR_landlock_create_ruleset,rsattr,size,flags);
15}
16
17int landlock_add_rule(int fd,enum landlock_rule_type t,void *attr,__u32 flags) {
18 return syscall(__NR_landlock_add_rule,fd,t,attr,flags);
19}
20
21int landlock_restrict_self(int fd,__u32 flags) {
22 prctl(PR_SET_NO_NEW_PRIVS,1,0,0,0);
23 int result = syscall(__NR_landlock_restrict_self,fd,flags);
24 if (result!=0) return result;
25 else {
26 close(fd);
27 return 0;
28 }
29}
30
31int create_full_ruleset() {
32 struct landlock_ruleset_attr attr;
33 attr.handled_access_fs = LANDLOCK_ACCESS_FS_READ_FILE | LANDLOCK_ACCESS_FS_READ_DIR | LANDLOCK_ACCESS_FS_WRITE_FILE | LANDLOCK_ACCESS_FS_REMOVE_FILE | LANDLOCK_ACCESS_FS_REMOVE_DIR | LANDLOCK_ACCESS_FS_MAKE_CHAR | LANDLOCK_ACCESS_FS_MAKE_DIR | LANDLOCK_ACCESS_FS_MAKE_REG | LANDLOCK_ACCESS_FS_MAKE_SOCK | LANDLOCK_ACCESS_FS_MAKE_FIFO | LANDLOCK_ACCESS_FS_MAKE_BLOCK | LANDLOCK_ACCESS_FS_MAKE_SYM | LANDLOCK_ACCESS_FS_EXECUTE;
34 return landlock_create_ruleset(&attr,sizeof(attr),0);
35}
36
37int add_read_access_rule_by_path(int rset_fd,char *allowed_path) {
38 int result;
39 int allowed_fd = open(allowed_path,O_PATH | O_CLOEXEC);
40 struct landlock_path_beneath_attr target;
41 target.parent_fd = allowed_fd;
42 target.allowed_access = LANDLOCK_ACCESS_FS_READ_FILE | LANDLOCK_ACCESS_FS_READ_DIR;
43 result = landlock_add_rule(rset_fd,LANDLOCK_RULE_PATH_BENEATH,&target,0);
44 close(allowed_fd);
45 return result;
46}
47
48int add_write_access_rule_by_path(int rset_fd,char *allowed_path) {
49 int result;
50 int allowed_fd = open(allowed_path,O_PATH | O_CLOEXEC);
51 struct landlock_path_beneath_attr target;
52 target.parent_fd = allowed_fd;
53 target.allowed_access = LANDLOCK_ACCESS_FS_WRITE_FILE | LANDLOCK_ACCESS_FS_REMOVE_FILE | LANDLOCK_ACCESS_FS_REMOVE_DIR | LANDLOCK_ACCESS_FS_MAKE_CHAR | LANDLOCK_ACCESS_FS_MAKE_DIR | LANDLOCK_ACCESS_FS_MAKE_REG | LANDLOCK_ACCESS_FS_MAKE_SYM;
54 result = landlock_add_rule(rset_fd,LANDLOCK_RULE_PATH_BENEATH,&target,0);
55 close(allowed_fd);
56 return result;
57}
58
59int add_create_special_rule_by_path(int rset_fd,char *allowed_path) {
60 int result;
61 int allowed_fd = open(allowed_path,O_PATH | O_CLOEXEC);
62 struct landlock_path_beneath_attr target;
63 target.parent_fd = allowed_fd;
64 target.allowed_access = LANDLOCK_ACCESS_FS_MAKE_SOCK | LANDLOCK_ACCESS_FS_MAKE_FIFO | LANDLOCK_ACCESS_FS_MAKE_BLOCK;
65 result = landlock_add_rule(rset_fd,LANDLOCK_RULE_PATH_BENEATH,&target,0);
66 close(allowed_fd);
67 return result;
68}
69
70int add_execute_rule_by_path(int rset_fd,char *allowed_path) {
71 int result;
72 int allowed_fd = open(allowed_path,O_PATH | O_CLOEXEC);
73 struct landlock_path_beneath_attr target;
74 target.parent_fd = allowed_fd;
75 target.allowed_access = LANDLOCK_ACCESS_FS_EXECUTE;
76 result = landlock_add_rule(rset_fd,LANDLOCK_RULE_PATH_BENEATH,&target,0);
77 close(allowed_fd);
78 return result;
79}
diff --git a/src/firejail/main.c b/src/firejail/main.c
index 3f0dc960a..29c25dfc5 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -81,11 +81,6 @@ int arg_seccomp_postexec = 0; // need postexec ld.preload library?
81int arg_seccomp_block_secondary = 0; // block any secondary architectures 81int arg_seccomp_block_secondary = 0; // block any secondary architectures
82int arg_seccomp_error_action = 0; 82int arg_seccomp_error_action = 0;
83 83
84#ifdef HAVE_LANDLOCK
85int arg_landlock = -1; // Landlock ruleset file descriptor (-1 if it doesn't exist)
86int arg_landlock_proc = 0; // Landlock rule for accessing /proc (0 for no access, 1 for read-only and 2 for read-write)
87#endif
88
89int arg_caps_default_filter = 0; // enable default capabilities filter 84int arg_caps_default_filter = 0; // enable default capabilities filter
90int arg_caps_drop = 0; // drop list 85int arg_caps_drop = 0; // drop list
91int arg_caps_drop_all = 0; // drop all capabilities 86int arg_caps_drop_all = 0; // drop all capabilities
@@ -1406,82 +1401,6 @@ int main(int argc, char **argv, char **envp) {
1406 else 1401 else
1407 exit_err_feature("seccomp"); 1402 exit_err_feature("seccomp");
1408 } 1403 }
1409#ifdef HAVE_LANDLOCK
1410 else if (strcmp(argv[i], "--landlock") == 0) {
1411 if (arg_landlock == -1) arg_landlock = create_full_ruleset();
1412 const char *home_dir = env_get("HOME");
1413 int home_fd = open(home_dir,O_PATH | O_CLOEXEC);
1414 struct landlock_path_beneath_attr target;
1415 target.parent_fd = home_fd;
1416 target.allowed_access = LANDLOCK_ACCESS_FS_READ_FILE | LANDLOCK_ACCESS_FS_READ_DIR | LANDLOCK_ACCESS_FS_WRITE_FILE | LANDLOCK_ACCESS_FS_REMOVE_FILE | LANDLOCK_ACCESS_FS_REMOVE_DIR | LANDLOCK_ACCESS_FS_MAKE_CHAR | LANDLOCK_ACCESS_FS_MAKE_DIR | LANDLOCK_ACCESS_FS_MAKE_REG | LANDLOCK_ACCESS_FS_MAKE_SYM;
1417 if (landlock_add_rule(arg_landlock,LANDLOCK_RULE_PATH_BENEATH,&target,0)) {
1418 fprintf(stderr,"An error has occured while adding a rule to the Landlock ruleset.\n");
1419 }
1420 close(home_fd);
1421 if (add_read_access_rule_by_path(arg_landlock, "/bin/")) {
1422 fprintf(stderr,"An error has occured while adding a rule to the Landlock ruleset.\n");
1423 }
1424 if (add_execute_rule_by_path(arg_landlock, "/bin/")) {
1425 fprintf(stderr,"An error has occured while adding a rule to the Landlock ruleset.\n");
1426 }
1427 if (add_read_access_rule_by_path(arg_landlock, "/dev/")) {
1428 fprintf(stderr,"An error has occured while adding a rule to the Landlock ruleset.\n");
1429 }
1430 if (add_read_access_rule_by_path(arg_landlock, "/etc/")) {
1431 fprintf(stderr,"An error has occured while adding a rule to the Landlock ruleset.\n");
1432 }
1433 if (add_read_access_rule_by_path(arg_landlock, "/lib/")) {
1434 fprintf(stderr,"An error has occured while adding a rule to the Landlock ruleset.\n");
1435 }
1436 if (add_execute_rule_by_path(arg_landlock, "/lib/")) {
1437 fprintf(stderr,"An error has occured while adding a rule to the Landlock ruleset.\n");
1438 }
1439 if (add_read_access_rule_by_path(arg_landlock, "/opt/")) {
1440 fprintf(stderr,"An error has occured while adding a rule to the Landlock ruleset.\n");
1441 }
1442 if (add_execute_rule_by_path(arg_landlock, "/opt/")) {
1443 fprintf(stderr,"An error has occured while adding a rule to the Landlock ruleset.\n");
1444 }
1445 if (add_read_access_rule_by_path(arg_landlock, "/usr/")) {
1446 fprintf(stderr,"An error has occured while adding a rule to the Landlock ruleset.\n");
1447 }
1448 if (add_execute_rule_by_path(arg_landlock, "/usr/")) {
1449 fprintf(stderr,"An error has occured while adding a rule to the Landlock ruleset.\n");
1450 }
1451 if (add_read_access_rule_by_path(arg_landlock, "/var/")) {
1452 fprintf(stderr,"An error has occured while adding a rule to the Landlock ruleset.\n");
1453 }
1454 }
1455 else if (strncmp(argv[i], "--landlock.proc=", 16) == 0) {
1456 if (strncmp(argv[i]+16, "no", 2) == 0) arg_landlock_proc = 0;
1457 else if (strncmp(argv[i]+16, "ro", 2) == 0) arg_landlock_proc = 1;
1458 else if (strncmp(argv[i]+16, "rw", 2) == 0) arg_landlock_proc = 2;
1459 }
1460 else if (strncmp(argv[i], "--landlock.read=", 16) == 0) {
1461 if (arg_landlock == -1) arg_landlock = create_full_ruleset();
1462 if (add_read_access_rule_by_path(arg_landlock, argv[i]+16)) {
1463 fprintf(stderr,"An error has occured while adding a rule to the Landlock ruleset.\n");
1464 }
1465 }
1466 else if (strncmp(argv[i], "--landlock.write=", 17) == 0) {
1467 if (arg_landlock == -1) arg_landlock = create_full_ruleset();
1468 if (add_write_access_rule_by_path(arg_landlock, argv[i]+17)) {
1469 fprintf(stderr,"An error has occured while adding a rule to the Landlock ruleset.\n");
1470 }
1471 }
1472 else if (strncmp(argv[i], "--landlock.special=", 17) == 0) {
1473 if (arg_landlock == -1) arg_landlock = create_full_ruleset();
1474 if (add_create_special_rule_by_path(arg_landlock, argv[i]+17)) {
1475 fprintf(stderr,"An error has occured while adding a rule to the Landlock ruleset.\n");
1476 }
1477 }
1478 else if (strncmp(argv[i], "--landlock.execute=", 19) == 0) {
1479 if (arg_landlock == -1) arg_landlock = create_full_ruleset();
1480 if (add_execute_rule_by_path(arg_landlock, argv[i]+19)) {
1481 fprintf(stderr,"An error has occured while adding a rule to the Landlock ruleset.\n");
1482 }
1483 }
1484#endif
1485 else if (strcmp(argv[i], "--memory-deny-write-execute") == 0) { 1404 else if (strcmp(argv[i], "--memory-deny-write-execute") == 0) {
1486 if (checkcfg(CFG_SECCOMP)) 1405 if (checkcfg(CFG_SECCOMP))
1487 arg_memory_deny_write_execute = 1; 1406 arg_memory_deny_write_execute = 1;
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index 9a2f8c82c..f406e2c53 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -1045,90 +1045,6 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
1045 return 0; 1045 return 0;
1046 } 1046 }
1047 1047
1048#ifdef HAVE_LANDLOCK
1049 // Landlock ruleset paths
1050 if (strcmp(ptr, "landlock") == 0) {
1051 if (arg_landlock == -1) arg_landlock = create_full_ruleset();
1052 const char *home_dir = env_get("HOME");
1053 int home_fd = open(home_dir,O_PATH | O_CLOEXEC);
1054 struct landlock_path_beneath_attr target;
1055 target.parent_fd = home_fd;
1056 target.allowed_access = LANDLOCK_ACCESS_FS_READ_FILE | LANDLOCK_ACCESS_FS_READ_DIR | LANDLOCK_ACCESS_FS_WRITE_FILE | LANDLOCK_ACCESS_FS_REMOVE_FILE | LANDLOCK_ACCESS_FS_REMOVE_DIR | LANDLOCK_ACCESS_FS_MAKE_CHAR | LANDLOCK_ACCESS_FS_MAKE_DIR | LANDLOCK_ACCESS_FS_MAKE_REG | LANDLOCK_ACCESS_FS_MAKE_SYM;
1057 if (landlock_add_rule(arg_landlock,LANDLOCK_RULE_PATH_BENEATH,&target,0)) {
1058 fprintf(stderr,"An error has occured while adding a rule to the Landlock ruleset.\n");
1059 }
1060 close(home_fd);
1061 if (add_read_access_rule_by_path(arg_landlock, "/bin/")) {
1062 fprintf(stderr,"An error has occured while adding a rule to the Landlock ruleset.\n");
1063 }
1064 if (add_execute_rule_by_path(arg_landlock, "/bin/")) {
1065 fprintf(stderr,"An error has occured while adding a rule to the Landlock ruleset.\n");
1066 }
1067 if (add_read_access_rule_by_path(arg_landlock, "/dev/")) {
1068 fprintf(stderr,"An error has occured while adding a rule to the Landlock ruleset.\n");
1069 }
1070 if (add_read_access_rule_by_path(arg_landlock, "/etc/")) {
1071 fprintf(stderr,"An error has occured while adding a rule to the Landlock ruleset.\n");
1072 }
1073 if (add_read_access_rule_by_path(arg_landlock, "/lib/")) {
1074 fprintf(stderr,"An error has occured while adding a rule to the Landlock ruleset.\n");
1075 }
1076 if (add_execute_rule_by_path(arg_landlock, "/lib/")) {
1077 fprintf(stderr,"An error has occured while adding a rule to the Landlock ruleset.\n");
1078 }
1079 if (add_read_access_rule_by_path(arg_landlock, "/opt/")) {
1080 fprintf(stderr,"An error has occured while adding a rule to the Landlock ruleset.\n");
1081 }
1082 if (add_execute_rule_by_path(arg_landlock, "/opt/")) {
1083 fprintf(stderr,"An error has occured while adding a rule to the Landlock ruleset.\n");
1084 }
1085 if (add_read_access_rule_by_path(arg_landlock, "/usr/")) {
1086 fprintf(stderr,"An error has occured while adding a rule to the Landlock ruleset.\n");
1087 }
1088 if (add_execute_rule_by_path(arg_landlock, "/usr/")) {
1089 fprintf(stderr,"An error has occured while adding a rule to the Landlock ruleset.\n");
1090 }
1091 if (add_read_access_rule_by_path(arg_landlock, "/var/")) {
1092 fprintf(stderr,"An error has occured while adding a rule to the Landlock ruleset.\n");
1093 }
1094 return 0;
1095 }
1096 if (strncmp(ptr, "landlock.proc ", 14) == 0) {
1097 if (strncmp(ptr+14, "no", 2) == 0) arg_landlock_proc = 0;
1098 else if (strncmp(ptr+14, "ro", 2) == 0) arg_landlock_proc = 1;
1099 else if (strncmp(ptr+14, "rw", 2) == 0) arg_landlock_proc = 2;
1100 return 0;
1101 }
1102 if (strncmp(ptr, "landlock.read ", 14) == 0) {
1103 if (arg_landlock == -1) arg_landlock = create_full_ruleset();
1104 if (add_read_access_rule_by_path(arg_landlock, ptr+14)) {
1105 fprintf(stderr,"An error has occured while adding a rule to the Landlock ruleset.\n");
1106 }
1107 return 0;
1108 }
1109 if (strncmp(ptr, "landlock.write ", 15) == 0) {
1110 if (arg_landlock == -1) arg_landlock = create_full_ruleset();
1111 if (add_write_access_rule_by_path(arg_landlock, ptr+15)) {
1112 fprintf(stderr,"An error has occured while adding a rule to the Landlock ruleset.\n");
1113 }
1114 return 0;
1115 }
1116 if (strncmp(ptr, "landlock.special ", 26) == 0) {
1117 if (arg_landlock == -1) arg_landlock = create_full_ruleset();
1118 if (add_create_special_rule_by_path(arg_landlock, ptr+26)) {
1119 fprintf(stderr,"An error has occured while adding a rule to the Landlock ruleset.\n");
1120 }
1121 return 0;
1122 }
1123 if (strncmp(ptr, "landlock.execute ", 17) == 0) {
1124 if (arg_landlock == -1) arg_landlock = create_full_ruleset();
1125 if (add_execute_rule_by_path(arg_landlock, ptr+17)) {
1126 fprintf(stderr,"An error has occured while adding a rule to the Landlock ruleset.\n");
1127 }
1128 return 0;
1129 }
1130#endif
1131
1132 // memory deny write&execute 1048 // memory deny write&execute
1133 if (strcmp(ptr, "memory-deny-write-execute") == 0) { 1049 if (strcmp(ptr, "memory-deny-write-execute") == 0) {
1134 if (checkcfg(CFG_SECCOMP)) 1050 if (checkcfg(CFG_SECCOMP))
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 5fcccbd92..9299268a3 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -488,7 +488,6 @@ void start_application(int no_sandbox, int fd, char *set_sandbox_status) {
488#ifdef HAVE_APPARMOR 488#ifdef HAVE_APPARMOR
489 set_apparmor(); 489 set_apparmor();
490#endif 490#endif
491
492 close_file_descriptors(); 491 close_file_descriptors();
493 492
494 // set nice and rlimits 493 // set nice and rlimits
@@ -510,16 +509,6 @@ void start_application(int no_sandbox, int fd, char *set_sandbox_status) {
510 printf("LD_PRELOAD=%s\n", getenv("LD_PRELOAD")); 509 printf("LD_PRELOAD=%s\n", getenv("LD_PRELOAD"));
511 } 510 }
512 511
513#ifdef HAVE_LANDLOCK
514 // set Landlock
515 if (arg_landlock >= 0) {
516 if (landlock_restrict_self(arg_landlock,0)) {
517 fprintf(stderr,"An error has occured while enabling Landlock self-restriction. Exiting...\n");
518 exit(1); // it isn't safe to continue if Landlock self-restriction was enabled and the "landlock_restrict_self" syscall has failed
519 }
520 }
521#endif
522
523 if (just_run_the_shell) { 512 if (just_run_the_shell) {
524 char *arg[2]; 513 char *arg[2];
525 arg[0] = cfg.usershell; 514 arg[0] = cfg.usershell;
@@ -1010,15 +999,6 @@ int sandbox(void* sandbox_arg) {
1010 fs_proc_sys_dev_boot(); 999 fs_proc_sys_dev_boot();
1011 1000
1012 //**************************** 1001 //****************************
1013 // Allow access to /proc
1014 //****************************
1015#ifdef HAVE_LANDLOCK
1016 if (arg_landlock>-1) {
1017 if (arg_landlock_proc >= 1) add_read_access_rule_by_path(arg_landlock, "/proc/");
1018 if (arg_landlock_proc == 2) add_write_access_rule_by_path(arg_landlock, "/proc/");
1019}
1020#endif
1021 //****************************
1022 // handle /mnt and /media 1002 // handle /mnt and /media
1023 //**************************** 1003 //****************************
1024 if (checkcfg(CFG_DISABLE_MNT)) 1004 if (checkcfg(CFG_DISABLE_MNT))
@@ -1113,12 +1093,9 @@ int sandbox(void* sandbox_arg) {
1113 //**************************** 1093 //****************************
1114 // rebuild etc directory, set dns 1094 // rebuild etc directory, set dns
1115 //**************************** 1095 //****************************
1116 if (!arg_writable_etc){ 1096 if (!arg_writable_etc)
1117 fs_rebuild_etc(); 1097 fs_rebuild_etc();
1118#ifdef HAVE_LANDLOCK 1098
1119 if (arg_landlock>-1) add_read_access_rule_by_path(arg_landlock, "/etc/");
1120#endif
1121 }
1122 //**************************** 1099 //****************************
1123 // start dhcp client 1100 // start dhcp client
1124 //**************************** 1101 //****************************
diff --git a/src/firejail/usage.c b/src/firejail/usage.c
index e0751ef5c..e11081eed 100644
--- a/src/firejail/usage.c
+++ b/src/firejail/usage.c
@@ -122,12 +122,6 @@ static char *usage_str =
122 " --keep-dev-shm - /dev/shm directory is untouched (even with --private-dev).\n" 122 " --keep-dev-shm - /dev/shm directory is untouched (even with --private-dev).\n"
123 " --keep-fd - inherit open file descriptors to sandbox.\n" 123 " --keep-fd - inherit open file descriptors to sandbox.\n"
124 " --keep-var-tmp - /var/tmp directory is untouched.\n" 124 " --keep-var-tmp - /var/tmp directory is untouched.\n"
125 " --landlock - add basic rules to the Landlock ruleset.\n"
126 " --landlock.proc=no|ro|rw - add an access rule for /proc to the Landlock ruleset.\n"
127 " --landlock.read=path - add a read access rule for the path to the Landlock ruleset.\n"
128 " --landlock.write=path - add a write access rule for the path to the Landlock ruleset.\n"
129 " --landlock.special=path - add an access rule for creating FIFO pipes, Unix domain sockets and block devices for the path to the Landlock ruleset.\n"
130 " --landlock.execute=path - add an execution-permitting rule for the path to the Landlock ruleset.\n"
131 " --list - list all sandboxes.\n" 125 " --list - list all sandboxes.\n"
132#ifdef HAVE_FILE_TRANSFER 126#ifdef HAVE_FILE_TRANSFER
133 " --ls=name|pid dir_or_filename - list files in sandbox container.\n" 127 " --ls=name|pid dir_or_filename - list files in sandbox container.\n"
diff --git a/src/firejail/util.c b/src/firejail/util.c
index b6a7ca08c..a01290cf2 100644
--- a/src/firejail/util.c
+++ b/src/firejail/util.c
@@ -1338,10 +1338,6 @@ void close_all(int *keep_list, size_t sz) {
1338 if (keep) 1338 if (keep)
1339 continue; 1339 continue;
1340 1340
1341 // don't close the file descriptor of the Landlock ruleset -- it will be automatically closed by the landlock_restrict_self wrapper function
1342#ifdef HAVE_LANDLOCK
1343 if (fd == arg_landlock) continue;
1344#endif
1345 close(fd); 1341 close(fd);
1346 } 1342 }
1347 closedir(dir); 1343 closedir(dir);
diff --git a/src/man/firejail-profile.txt b/src/man/firejail-profile.txt
index 1f543980e..138aae8af 100644
--- a/src/man/firejail-profile.txt
+++ b/src/man/firejail-profile.txt
@@ -497,35 +497,6 @@ Blacklist all Linux capabilities.
497.TP 497.TP
498\fBcaps.keep capability,capability,capability 498\fBcaps.keep capability,capability,capability
499Whitelist given Linux capabilities. 499Whitelist given Linux capabilities.
500#ifdef HAVE_LANDLOCK
501.TP
502\fBlandlock
503Create a Landlock ruleset (if it doesn't already exist) and add basic access rules to it.
504.br
505.TP
506\fBlandlock.proc no|ro|rw
507Add an access rule for /proc directory (read-only if set to \fBro\fR and read-write if set to \fBrw\fR). The access rule for /proc is added after this directory is set up in the sandbox. Access rules for /proc set up with other Landlock-related profile options have no effect.
508.br
509.TP
510\fBlandlock.read path
511Create a Landlock ruleset (if it doesn't already exist) and add a read access rule for path.
512.br
513
514.TP
515\fBlandlock.write path
516Create a Landlock ruleset (if it doesn't already exist) and add a write access rule for path.
517.br
518
519.TP
520\fBlandlock.special path
521Create a Landlock ruleset (if it doesn't already exist) and add an access rule for creation of FIFO pipes, Unix-domain sockets and block devices beneath given path.
522.br
523
524.TP
525\fBlandlock.execute path
526Create a Landlock ruleset (if it doesn't already exist) and add an execution permission rule for path.
527.br
528#endif
529.TP 500.TP
530\fBmemory-deny-write-execute 501\fBmemory-deny-write-execute
531Install a seccomp filter to block attempts to create memory mappings 502Install a seccomp filter to block attempts to create memory mappings
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index 0b78203d7..1dd5508b3 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -1151,41 +1151,6 @@ Example:
1151.br 1151.br
1152$ firejail --keep-var-tmp 1152$ firejail --keep-var-tmp
1153 1153
1154#ifdef HAVE_LANDLOCK
1155.TP
1156\fB\-\-landlock
1157Create a Landlock ruleset (if it doesn't already exist) and add basic access rules to it. See \fBLANDLOCK\fR section for more information.
1158.br
1159.TP
1160\fB\-\-landlock.proc=no|ro|rw
1161Add an access rule for /proc directory (read-only if set to \fBro\fR and read-write if set to \fBrw\fR). The access rule for /proc is added after this directory is set up in the sandbox. Access rules for /proc set up with other Landlock-related command-line options have no effect.
1162.br
1163.TP
1164\fB\-\-landlock.read=path
1165Create a Landlock ruleset (if it doesn't already exist) and add a read access rule for path.
1166.br
1167
1168.TP
1169\fB\-\-landlock.write=path
1170Create a Landlock ruleset (if it doesn't already exist) and add a write access rule for path.
1171.br
1172
1173.TP
1174\fB\-\-landlock.special=path
1175Create a Landlock ruleset (if it doesn't already exist) and add a permission rule to create FIFO pipes, Unix domain sockets and block devices beneath given path.
1176.br
1177
1178.TP
1179\fB\-\-landlock.execute=path
1180Create a Landlock ruleset (if it doesn't already exist) and add an execution permission rule for path.
1181.br
1182
1183.br
1184Example:
1185.br
1186$ firejail \-\-landlock.read=/ \-\-landlock.write=/home \-\-landlock.execute=/usr
1187#endif
1188
1189.TP 1154.TP
1190\fB\-\-list 1155\fB\-\-list
1191List all sandboxes, see \fBMONITORING\fR section for more details. 1156List all sandboxes, see \fBMONITORING\fR section for more details.
@@ -1303,7 +1268,6 @@ $ firejail --list
1303.br 1268.br
13041312:netblue:browser-1312:firejail --name=browser --private firefox --no-remote 12691312:netblue:browser-1312:firejail --name=browser --private firefox --no-remote
1305.br 1270.br
1306
1307#ifdef HAVE_NETWORK 1271#ifdef HAVE_NETWORK
1308.TP 1272.TP
1309\fB\-\-net=bridge_interface 1273\fB\-\-net=bridge_interface
@@ -3237,34 +3201,7 @@ To enable AppArmor confinement on top of your current Firejail security features
3237.br 3201.br
3238$ firejail --apparmor firefox 3202$ firejail --apparmor firefox
3239#endif 3203#endif
3240#ifdef HAVE_LANDLOCK
3241.SH LANDLOCK
3242.TP
3243Landlock is a Linux security module first introduced in the 5.13 version of Linux kernel. It allows unprivileged processes to restrict their access to the filesystem. Once imposed, these restrictions can never be removed, and all child processes created by a Landlock-restricted processes inherit these restrictions. Firejail supports Landlock as an additional sandboxing feature. It can be used to ensure that a sandboxed application can only access files and directories that it was explicitly allowed to access. Firejail supports populating the ruleset with both basic set of rules and with custom set of rules. Basic set of rules allows read-only access to /bin, /dev, /etc, /lib, /opt, /proc, /usr and /var, read-write access to the home directory, and allows execution of binaries located in /bin, /opt and /usr.
3244.br
3245
3246.TP
3247Important notes:
3248.br
3249
3250.br
3251- A process can install a Landlock ruleset only if it has either \fBCAP_SYS_ADMIN\fR in its effective capability set, or the "No New Privileges" restriction enabled. Because of this, enabling the Landlock feature will also cause Firejail to enable the "No New Privileges" restriction, regardless of the profile or the \fB\-\-no\-new\-privs\fR command line option.
3252.br
3253 3204
3254.br
3255- Access to the /proc directory is managed through the \fB\-\-landlock.proc\fR command line option.
3256
3257.br
3258- Access to the /etc directory is automatically allowed. To override this, use the \fB\-\-writable\-etc\fR command line option. You can also use the \fB\-\-private\-etc\fR option to restrict access to the /etc directory.
3259.br
3260
3261.TP
3262To enable Landlock self-restriction on top of your current Firejail security features, pass \fB\-\-landlock\fR flag to Firejail command line. You can also use \fB\-\-landlock.read\fR, \fB\-\-landlock.write\fR, \fB\-\-landlock.special\fR and \fB\-\-landlock.execute\fR options together with \fB\-\-landlock\fR or instead of it. Example:
3263.br
3264
3265.br
3266$ firejail --landlock --landlock.read=/media --landlock.proc=ro mc
3267#endif
3268.SH DESKTOP INTEGRATION 3205.SH DESKTOP INTEGRATION
3269A symbolic link to /usr/bin/firejail under the name of a program, will start the program in Firejail sandbox. 3206A symbolic link to /usr/bin/firejail under the name of a program, will start the program in Firejail sandbox.
3270The symbolic link should be placed in the first $PATH position. On most systems, a good place 3207The symbolic link should be placed in the first $PATH position. On most systems, a good place
diff --git a/src/zsh_completion/_firejail.in b/src/zsh_completion/_firejail.in
index ed7337762..2b67c2a00 100644
--- a/src/zsh_completion/_firejail.in
+++ b/src/zsh_completion/_firejail.in
@@ -105,12 +105,6 @@ _firejail_args=(
105 '--keep-dev-shm[/dev/shm directory is untouched (even with --private-dev)]' 105 '--keep-dev-shm[/dev/shm directory is untouched (even with --private-dev)]'
106 '--keep-fd[inherit open file descriptors to sandbox]: :' 106 '--keep-fd[inherit open file descriptors to sandbox]: :'
107 '--keep-var-tmp[/var/tmp directory is untouched]' 107 '--keep-var-tmp[/var/tmp directory is untouched]'
108 '--landlock[Basic Landlock ruleset]'
109 '--landlock.proc=-[Access to the /proc directory]: :(no ro rw)'
110 '--landlock.read=-[Landlock read access rule]: :_files'
111 '--landlock.write=-[Landlock write access rule]: :_files'
112 "--landlock.special=-[Landlock access rule for creation of FIFO pipes, sockets and block devices]: :_files"
113 '--landlock.execute=-[Landlock execution-permitting rule]: :_files'
114 '--machine-id[spoof /etc/machine-id with a random id]' 108 '--machine-id[spoof /etc/machine-id with a random id]'
115 '--memory-deny-write-execute[seccomp filter to block attempts to create memory mappings that are both writable and executable]' 109 '--memory-deny-write-execute[seccomp filter to block attempts to create memory mappings that are both writable and executable]'
116 '*--mkdir=-[create a directory]:' 110 '*--mkdir=-[create a directory]:'
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-06-26 08:43:55 +0000