sandbox: Switch to exile.h (former qssb.h)

.gitmodules

@@ -4,6 +4,6 @@
 [submodule "submodules/cpp-httplib"]
 	path = submodules/cpp-httplib
 	url = https://github.com/yhirose/cpp-httplib
-[submodule "submodules/qssb.h"]
-	path = submodules/qssb.h
-	url = https://gitea.quitesimple.org/crtxcr/qssb.h.git
+[submodule "submodules/exile.h"]
+	path = submodules/exile.h
+	url = https://gitea.quitesimple.org/crtxcr/exile.h.git

Makefile

@@ -3,7 +3,7 @@ CPPSTD=c++20
 CXXFLAGS=-std=$(CPPSTD) -O0 -g -no-pie -pipe -MMD -Wall -Wextra
 RELEASE_CXXFLAGS=-std=$(CPPSTD) -O3 -pipe -MMD -Wall -Wextra
 LDFLAGS=-lsqlite3 -lpthread -lcrypto -lstdc++fs
-INCLUDEFLAGS=-I submodules/sqlitemoderncpp/hdr -I submodules/cpp-httplib -I submodules/qssb.h
+INCLUDEFLAGS=-I submodules/sqlitemoderncpp/hdr -I submodules/cpp-httplib -I submodules/exile.h
 
 CXX=g++
 

README.md

@@ -72,8 +72,7 @@ Building
 Dependencies:
   - cpp-httplib: https://github.com/yhirose/cpp-httplib
   - SqliteModernCpp: https://github.com/SqliteModernCpp
-  - qssb.h: https://gitea.quitesimple.org/crtxcr/qssb.h
-  - libseccomp: https://github.com/seccomp/libseccomp
+  - exile.h: https://gitea.quitesimple.org/crtxcr/exile.h
   - sqlite3: https://sqlite.org/index.html
     
 The first three are header-only libraries that are included as a git submodule. The others must

sandbox/sandbox-linux.cpp

@@ -13,7 +13,7 @@
 #include <sys/mount.h>
 #include <sys/capability.h>
 #define HAVE_LANDLOCK 0
-#include <qssb.h>
+#include <exile.h>
 #include "../logger.h"
 #include "../utils.h"
 #include "../random.h"
@@ -46,7 +46,7 @@ bool SandboxLinux::enable(std::vector<std::string> fsPaths)
 	std::sort(fsPaths.begin(), fsPaths.end(),
 			  [](const std::string &a, const std::string &b) { return a.length() < b.length(); });
 
-	struct qssb_policy *policy = qssb_init_policy();
+	struct exile_policy *policy = exile_init_policy();
 	if(policy == NULL)
 	{
 		Logger::error() << "Failed to init sandboxing policy (worker) ";
@@ -54,37 +54,37 @@ bool SandboxLinux::enable(std::vector<std::string> fsPaths)
 	}
 	for(unsigned int i = 0; i < fsPaths.size(); i++)
 	{
-		qssb_append_path_policy(policy, QSSB_FS_ALLOW_READ | QSSB_FS_ALLOW_WRITE, fsPaths[i].c_str());
+		exile_append_path_policy(policy, EXILE_FS_ALLOW_READ | EXILE_FS_ALLOW_WRITE, fsPaths[i].c_str());
 	}
 	policy->drop_caps = 1;
 	policy->not_dumpable = 1;
 	policy->no_new_privs = 1;
 	policy->mount_path_policies_to_chroot = 1;
 
-	if(qssb_append_group_syscall_policy(policy, QSSB_SYSCALL_ALLOW, QSSB_SYSCGROUP_DEFAULT_ALLOW) != 0)
+	if(exile_append_group_syscall_policy(policy, EXILE_SYSCALL_ALLOW, EXILE_SYSCGROUP_DEFAULT_ALLOW) != 0)
 	{
 		Logger::error() << "Sandbox: Failed to add whitelist!";
-		qssb_free_policy(policy);
+		exile_free_policy(policy);
 		return false;
 	}
-	if(qssb_append_group_syscall_policy(policy, QSSB_SYSCALL_ALLOW, QSSB_SYSCGROUP_SOCKET | QSSB_SYSCGROUP_FUTEX | QSSB_SYSCGROUP_PATH | QSSB_SYSCGROUP_SCHED | EXILE_SYSCGROUP_TIME) != 0)
+	if(exile_append_group_syscall_policy(policy, EXILE_SYSCALL_ALLOW, EXILE_SYSCGROUP_SOCKET | EXILE_SYSCGROUP_FUTEX | EXILE_SYSCGROUP_PATH | EXILE_SYSCGROUP_SCHED | EXILE_SYSCGROUP_TIME) != 0)
 	{
 		Logger::error() << "Sandbox: Failed to add socket group!";
-		qssb_free_policy(policy);
+		exile_free_policy(policy);
 		return false;
 	}
-	if(qssb_append_syscall_default_policy(policy, QSSB_SYSCALL_DENY_KILL_PROCESS) != 0)
+	if(exile_append_syscall_default_policy(policy, EXILE_SYSCALL_DENY_KILL_PROCESS) != 0)
 	{
 		Logger::error() << "Sandbox: Default policy";
-		qssb_free_policy(policy);
+		exile_free_policy(policy);
 		return false;
 	}
-	if(qssb_enable_policy(policy) != 0)
+	if(exile_enable_policy(policy) != 0)
 	{
 		Logger::error() << "Sandbox: Activation of seccomp blacklist failed!";
-		qssb_free_policy(policy);
+		exile_free_policy(policy);
 		return false;
 	}
-	qssb_free_policy(policy);
+	exile_free_policy(policy);
 	return true;
 }

submodules/exile.h

@@ -0,0 +1 @@
+Subproject commit 1b4c5477a55191f74d29bc264678e041bf0f2a42

submodules/qssb.h

@@ -1 +0,0 @@
-Subproject commit d847d0f996679c77741b85959988dd9e65d63b97