github-starred/firejail
2
0
Fork 0
mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00
Code Issues 531 Projects Packages Wiki Activity Actions 6

landlock: expand simple macros in commands

Browse source 
This includes macros such as `${HOME}` and `${RUNUSER}`, but not
`${PATH}`, which may expand to multiple strings.

Relates to #6078.
This commit is contained in:
Kelvin M. Klann 2023-11-11 14:15:50 -03:00
parent d44be8ed94
commit 19e108248c
1 changed files with 16 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

29
src/firejail/landlock.c
View file

@ -117,8 +117,8 @@ static int ll_create_full_ruleset(void) {
return ruleset_fd;
}
static int ll_fs(const char *allowed_path, const __u64 allowed_access,
const char *caller) {
static int _ll_fs(const char *allowed_path, const __u64 allowed_access,
const char *caller) {
if (!ll_is_supported())
return 0;
@ -155,6 +155,16 @@ static int ll_fs(const char *allowed_path, const __u64 allowed_access,
return error;
}
// TODO: Add support for the ${PATH} macro.
static int ll_fs(const char *allowed_path, const __u64 allowed_access,
const char *caller) {
char *expanded_path = expand_macros(allowed_path);
int error = _ll_fs(expanded_path, allowed_access, caller);
free(expanded_path);
return error;
}
int ll_read(const char *allowed_path) {
__u64 allowed_access =
LANDLOCK_ACCESS_FS_READ_DIR |
@ -193,28 +203,21 @@ int ll_exec(const char *allowed_path) {
}
int ll_basic_system(void) {
assert(cfg.homedir);
if (!ll_is_supported())
return 0;
if (ll_ruleset_fd == -1)
ll_ruleset_fd = ll_create_full_ruleset();
int error;
char *rundir;
if (asprintf(&rundir, "/run/user/%d", getuid()) == -1)
errExit("asprintf");
error =
int error =
ll_read("/") || // whole system read
ll_special("/") || // sockets etc.
ll_write("/tmp") || // write access
ll_write("/dev") ||
ll_write("/run/shm") ||
ll_write(cfg.homedir) ||
ll_write(rundir) ||
ll_write("${HOME}") ||
ll_write("${RUNUSER}") ||
ll_exec("/opt") || // exec access
ll_exec("/bin") ||
@ -240,7 +243,7 @@ int ll_basic_system(void) {
fprintf(stderr, "Error: %s: failed to set --landlock rules\n",
__func__);
}
free(rundir);
return error;
}