exile_flags_to_landlock(): Cover more with ALL_WRITE, except devices

More consistent with mount(), where MS_NODEV disallows those. We may need to introduce a flag that simply allows everything
append_syscall_to_bpf(): Check for unlikely case of too many sock_filters
2022-03-17 15:47:22 +01:00 · 2022-03-17 15:47:22 +01:00 · 2022-03-17 15:47:22 +01:00 · 2022-03-17 15:47:22 +01:00 · 2022-03-17 15:47:22 +01:00 · 2022-03-17 15:47:22 +01:00
--- a/exile.c
+++ b/exile.c
@ -1208,9 +1208,12 @@ static unsigned int exile_flags_to_landlock(unsigned int flags, int statmode)
 		result |= LANDLOCK_ACCESS_FS_WRITE_FILE;
 		if(S_ISDIR(statmode))
 		{
-			result |= LANDLOCK_ACCESS_FS_REMOVE_FILE;
-			result |= LANDLOCK_ACCESS_FS_MAKE_REG;
 			result |= LANDLOCK_ACCESS_FS_REMOVE_DIR;
+			result |= LANDLOCK_ACCESS_FS_REMOVE_FILE;
+			result |= LANDLOCK_ACCESS_FS_MAKE_DIR;
+			result |= LANDLOCK_ACCESS_FS_MAKE_FIFO;
+			result |= LANDLOCK_ACCESS_FS_MAKE_REG;
+			result |= LANDLOCK_ACCESS_FS_MAKE_SOCK;
 			result |= LANDLOCK_ACCESS_FS_MAKE_SYM;
 		}
 	}
مولف	SHA1	پیام	تاریخ
Albert S	ea66ef76eb	exile_flags_to_landlock(): Cover more with ALL_WRITE, except devices More consistent with mount(), where MS_NODEV disallows those. We may need to introduce a flag that simply allows everything	2022-03-17 15:47:22 +01:00
Albert S	66def7a28f	append_syscall_to_bpf(): Check for unlikely case of too many sock_filters	2022-03-17 15:47:22 +01:00
Albert S	dbf8e87440	exile.hpp: Mark do_clone inline, not static	2022-03-17 15:47:22 +01:00
Albert S	98421fab90	Makefile: Build exile.o separately, link it in all tests	2022-03-17 15:47:22 +01:00
Albert S	70c3fef500	exile.h: Retire static child_read/write_pipe vars	2022-03-17 15:47:22 +01:00
Albert S	69829374c7	exile.h: Move definitions to new file exile.c Especially with exile_launch(), we will be included from more than one translation unit. Thus, ODR becomes a headache now. So move definitions to exile.c.	2022-03-17 15:47:22 +01:00
Albert S	005851c645	exile.h: Add extern "C" guards	2022-03-17 15:47:22 +01:00
Albert S	95fa11e928	c++: Add explicit exile_launch() std::basic_string variant	2022-03-17 15:47:22 +01:00
Albert S	97e2025758	c++: Retire exile_launch_trivial(), use std::enable_if	2022-03-17 15:47:22 +01:00
Albert S	8cfb73568a	Makefile: Add 'tests' target, depend on headers too to rebuild on changes of those	2022-03-17 15:47:22 +01:00
Albert S	e7a5ba7f7f	test.sh: Also run C++ tests	2022-03-17 15:47:22 +01:00
Albert S	e52eda186b	Add test.cpp to test C++ API	2022-03-17 15:47:22 +01:00
Albert S	90ed5bbae9	Begin C++ API: Add exile.hpp with exile_launch() wrappers	2022-03-17 15:47:22 +01:00
Albert S	48b6de9036	struct syscall_vow_map: change 'str' to const char*	2022-03-17 15:47:22 +01:00
Albert S	93acb13929	test: Introduce LOG(), avoid inconsistent printf/fprintf	2022-03-17 15:47:22 +01:00
Albert S	9247a6636b	Introduce exile_vows_from_str()	2022-03-17 15:47:22 +01:00