From cfbde6658080ee57f37c7a1149c7f1cd9f7fdf91 Mon Sep 17 00:00:00 2001 From: "Kelvin M. Klann" Date: Wed, 8 Nov 2023 07:57:41 -0300 Subject: landlock: deduplicate fs functions into ll_fs The relevant functions are all identical except for the access flags used. Relates to #6078. --- src/firejail/landlock.c | 103 +++++++++--------------------------------------- 1 file changed, 19 insertions(+), 84 deletions(-) diff --git a/src/firejail/landlock.c b/src/firejail/landlock.c index d89b031a8..65a4cd8df 100644 --- a/src/firejail/landlock.c +++ b/src/firejail/landlock.c @@ -108,7 +108,8 @@ static int ll_create_full_ruleset(void) { return ruleset_fd; } -int ll_read(const char *allowed_path) { +static int ll_fs(const char *allowed_path, const __u64 allowed_access, + const char *caller) { if (!ll_is_supported()) return 0; @@ -120,45 +121,34 @@ int ll_read(const char *allowed_path) { if (allowed_fd < 0) { if (arg_debug) { fprintf(stderr, "%s: failed to open %s: %s\n", - __func__, allowed_path, strerror(errno)); + caller, allowed_path, strerror(errno)); } return 0; } + struct landlock_path_beneath_attr target; target.parent_fd = allowed_fd; - target.allowed_access = - LANDLOCK_ACCESS_FS_READ_DIR | - LANDLOCK_ACCESS_FS_READ_FILE; - + target.allowed_access = allowed_access; error = landlock_add_rule(ll_ruleset_fd, LANDLOCK_RULE_PATH_BENEATH, &target, 0); if (error) { fprintf(stderr, "Error: %s: failed to add Landlock rule for %s: %s\n", - __func__, allowed_path, strerror(errno)); + caller, allowed_path, strerror(errno)); } close(allowed_fd); return error; } -int ll_write(const char *allowed_path) { - if (!ll_is_supported()) - return 0; +int ll_read(const char *allowed_path) { + __u64 allowed_access = + LANDLOCK_ACCESS_FS_READ_DIR | + LANDLOCK_ACCESS_FS_READ_FILE; - if (ll_ruleset_fd == -1) - ll_ruleset_fd = ll_create_full_ruleset(); + return ll_fs(allowed_path, allowed_access, __func__); +} - int error; - int allowed_fd = open(allowed_path, O_PATH | O_CLOEXEC); - if (allowed_fd < 0) { - if (arg_debug) { - fprintf(stderr, "%s: failed to open %s: %s\n", - __func__, allowed_path, strerror(errno)); - } - return 0; - } - struct landlock_path_beneath_attr target; - target.parent_fd = allowed_fd; - target.allowed_access = +int ll_write(const char *allowed_path) { + __u64 allowed_access = LANDLOCK_ACCESS_FS_MAKE_DIR | LANDLOCK_ACCESS_FS_MAKE_REG | LANDLOCK_ACCESS_FS_MAKE_SYM | @@ -166,79 +156,24 @@ int ll_write(const char *allowed_path) { LANDLOCK_ACCESS_FS_REMOVE_FILE | LANDLOCK_ACCESS_FS_WRITE_FILE; - error = landlock_add_rule(ll_ruleset_fd, LANDLOCK_RULE_PATH_BENEATH, - &target, 0); - if (error) { - fprintf(stderr, "Error: %s: failed to add Landlock rule for %s: %s\n", - __func__, allowed_path, strerror(errno)); - } - close(allowed_fd); - return error; + return ll_fs(allowed_path, allowed_access, __func__); } int ll_special(const char *allowed_path) { - if (!ll_is_supported()) - return 0; - - if (ll_ruleset_fd == -1) - ll_ruleset_fd = ll_create_full_ruleset(); - - int error; - int allowed_fd = open(allowed_path, O_PATH | O_CLOEXEC); - if (allowed_fd < 0) { - if (arg_debug) { - fprintf(stderr, "%s: failed to open %s: %s\n", - __func__, allowed_path, strerror(errno)); - } - return 0; - } - struct landlock_path_beneath_attr target; - target.parent_fd = allowed_fd; - target.allowed_access = + __u64 allowed_access = LANDLOCK_ACCESS_FS_MAKE_BLOCK | LANDLOCK_ACCESS_FS_MAKE_CHAR | LANDLOCK_ACCESS_FS_MAKE_FIFO | LANDLOCK_ACCESS_FS_MAKE_SOCK; - error = landlock_add_rule(ll_ruleset_fd, LANDLOCK_RULE_PATH_BENEATH, - &target, 0); - if (error) { - fprintf(stderr, "Error: %s: failed to add Landlock rule for %s: %s\n", - __func__, allowed_path, strerror(errno)); - } - close(allowed_fd); - return error; + return ll_fs(allowed_path, allowed_access, __func__); } int ll_exec(const char *allowed_path) { - if (!ll_is_supported()) - return 0; - - if (ll_ruleset_fd == -1) - ll_ruleset_fd = ll_create_full_ruleset(); - - int error; - int allowed_fd = open(allowed_path, O_PATH | O_CLOEXEC); - if (allowed_fd < 0) { - if (arg_debug) { - fprintf(stderr, "%s: failed to open %s: %s\n", - __func__, allowed_path, strerror(errno)); - } - return 0; - } - struct landlock_path_beneath_attr target; - target.parent_fd = allowed_fd; - target.allowed_access = + __u64 allowed_access = LANDLOCK_ACCESS_FS_EXECUTE; - error = landlock_add_rule(ll_ruleset_fd, LANDLOCK_RULE_PATH_BENEATH, - &target, 0); - if (error) { - fprintf(stderr, "Error: %s: failed to add Landlock rule for %s: %s\n", - __func__, allowed_path, strerror(errno)); - } - close(allowed_fd); - return error; + return ll_fs(allowed_path, allowed_access, __func__); } int ll_basic_system(void) { -- cgit v1.2.3-70-g09d2