atagen/yoke
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

rework features, add abi support, add fd args

Browse source
This commit is contained in:
atagen 2025-11-06 17:06:03 +11:00
parent ab083b07e4
commit 2341a204bb
6 changed files with 176 additions and 63 deletions
Download patch file Download diff file Expand all files Collapse all files

16
Cargo.toml
View file

@ -2,21 +2,27 @@
name = "yoke"
version = "0.1.0"
authors = [ "atagen" ]
description = "CLI sandboxing tool similar to landrun or bwrap"
description = "CLI sandboxing tool (similar to landrun or bwrap)"
repository = "https://git.atagen.co/atagen/yoke"
license = "GPL-3.0-or-later"
edition = "2024"
[features]
default = []
ldd = ["dep:elb-dl"]
which = ["dep:which"]
default = [ "abi-6", "cli" ]
cli = ["dep:elb-dl", "dep:which"]
nix = []
abi-1 = []
abi-2 = []
abi-3 = []
abi-4 = []
abi-5 = []
abi-6 = []
[profile.release]
strip = true
opt-level = "s"
codegen-units = 1
lto = true
[dependencies]
anyhow = "1.0.100"

32
flake.nix
View file

@ -26,26 +26,18 @@
});
packages = forAllSystems (pkgs: {
default = self.packages.${pkgs.system}.yoke;
yoke =
let
details = (builtins.fromTOML (builtins.readFile ./Cargo.toml)).package;
lib = pkgs.lib;
in
pkgs.rustPlatform.buildRustPackage (finalAttrs: {
pname = details.name;
inherit (details) version;
src = ./.;
cargoLock.lockFile = ./Cargo.lock;
RUSTFLAGS = "-C prefer-dynamic=yes";
meta = {
description = details.description;
homepage = details.repository;
license = lib.licenses.gpl3Plus;
maintainers = [ lib.maintainers.atagen ];
mainProgram = details.name;
};
});
yoke = pkgs.rustPlatform.callPackage ./nix/package.nix {
features = [
"cli"
];
};
yoke-lite = pkgs.rustPlatform.callPackage ./nix/package.nix { };
});
nixosModules.default =
{ pkgs, ... }:
{
imports = [ ./nix/module.nix ];
programs.yoke.package = self.packages.${pkgs.system}.yoke;
};
};
}

45
nix/package.nix Normal file
View file

@ -0,0 +1,45 @@
{
lib,
rustPlatform,
features ? [ ],
abi ? 6,
...
}:
let
details = (builtins.fromTOML (builtins.readFile ../Cargo.toml)).package;
in
rustPlatform.buildRustPackage (finalAttrs: {
pname = details.name;
inherit (details) version;
src = lib.cleanSourceWith {
src = lib.cleanSource ../.;
filter =
path_t: type:
let
path = toString path_t;
baseName = baseNameOf path;
parentDir = baseNameOf (dirOf path);
matchesSuffix = lib.any (suffix: lib.hasSuffix suffix baseName) [
".rs"
".toml"
];
isCargoFile = baseName == "Cargo.lock";
isCargoConf = parentDir == ".cargo" && baseName == "config";
in
type == "directory" || matchesSuffix || isCargoFile || isCargoConf;
};
cargoLock.lockFile = ../Cargo.lock;
buildNoDefaultFeatures = true;
buildFeatures = features ++ [
"nix"
"abi-${toString abi}"
];
meta = {
description = details.description;
homepage = details.repository;
license = lib.licenses.gpl3Plus;
maintainers = [ lib.maintainers.atagen ];
mainProgram = details.name;
};
})

122
src/main.rs
View file

@ -7,13 +7,26 @@ use landlock::{
RulesetCreatedAttr, Scope, make_bitflags, path_beneath_rules,
};
#[cfg(feature = "ldd")]
#[cfg(feature = "cli")]
use elb_dl::{DependencyTree, DynamicLoader, glibc};
#[cfg(feature = "ldd")]
#[cfg(feature = "cli")]
use std::{collections::VecDeque, path::PathBuf, str::FromStr};
use std::{fs::File, io::Read, os::fd::FromRawFd};
fn main() -> Result<()> {
let opts = parse::parse_args()?;
let args = std::env::args().skip(1);
let mut opts = parse::parse_args(args)?;
if opts.fd_args {
let mut fd = unsafe { File::from_raw_fd(3) };
let mut raw_args = String::new();
fd.read_to_string(&mut raw_args)?;
let args = raw_args
.split_ascii_whitespace()
.map(|s| s.to_string())
.collect::<Vec<String>>();
let fd_opts = parse::parse_args(args.into_iter())?;
opts.merge(fd_opts);
}
if opts.exec.is_empty() {
// print help
eprintln!(
@ -33,8 +46,8 @@ rules
env vars:
--env | -e [key]=[value]
clear inherited env vars:
--clear-env | -c
retain inherited env vars:
--retain-env | -r
allow use of external unix domain sockets:
--sockets | -s
@ -50,6 +63,9 @@ rules
--no-fs | -nf
--no-tcp | -nt
accept additional rules from fd 3:
--fd-args | -fd
access specifiers
------------
@ -77,16 +93,26 @@ examples
// set up scope of our intial ruleset
let mut preempt = Ruleset::default();
// TODO FIXME set up for lesser ABI versions
preempt = preempt.set_compatibility(landlock::CompatLevel::HardRequirement);
#[cfg(feature = "abi-2")]
let abi = ABI::V2;
#[cfg(feature = "abi-3")]
let abi = ABI::V3;
#[cfg(feature = "abi-4")]
let abi = ABI::V4;
#[cfg(feature = "abi-5")]
let abi = ABI::V5;
#[cfg(feature = "abi-6")]
let abi = ABI::V6;
// disallow signals to other processes
if !opts.signals {
if !opts.signals && abi >= ABI::V6 {
preempt = preempt.scope(Scope::Signal).context("scoping signals")?;
}
// disallow connections to unix domain sockets
if !opts.sockets {
if !opts.sockets && abi >= ABI::V6 {
preempt = preempt
.scope(Scope::AbstractUnixSocket)
.context("scoping sockets")?;
@ -95,14 +121,14 @@ examples
// lock down fs access
preempt = if !opts.unsandbox.fs {
preempt
.handle_access(AccessFs::from_all(ABI::V6))
.handle_access(AccessFs::from_all(abi))
.context("handling fs access")?
} else {
preempt
};
// lock down tcp access
preempt = if !opts.unsandbox.tcp {
preempt = if !(opts.unsandbox.tcp || abi < ABI::V3) {
preempt
.handle_access(AccessNet::BindTcp)
.context("handling tcp bind access")?
@ -122,8 +148,9 @@ examples
access.insert(make_bitflags!(AccessFs::{ReadFile | ReadDir}));
}
if perms.write {
access.insert(make_bitflags!(
AccessFs::{ WriteFile
let mut flags = make_bitflags!(
AccessFs::{
WriteFile
| RemoveDir
| RemoveFile
| MakeChar
@ -133,19 +160,33 @@ examples
| MakeFifo
| MakeBlock
| MakeSym
| Refer
| Truncate
}
));
);
match abi {
ABI::V2 => {
flags.insert(AccessFs::Refer);
}
_ if abi >= ABI::V3 => {
flags.insert(AccessFs::Refer | AccessFs::Truncate);
}
_ => (),
};
access.insert(flags);
}
if perms.execute {
access.insert(AccessFs::Execute);
}
if perms.ioctl {
access.insert(AccessFs::IoctlDev);
if abi >= ABI::V6 {
access.insert(AccessFs::IoctlDev);
} else {
return Err(anyhow!(
"ioctl is only available on Landlock ABI 6 or higher"
));
}
}
if access == BitFlags::empty() {
return Err(anyhow!("invalid filesystem permissions requested"));
return Err(anyhow!("invalid/empty filesystem permissions requested"));
}
ruleset = ruleset
.add_rules(path_beneath_rules(paths, access))
@ -153,41 +194,54 @@ examples
}
// allow each tcp action specified, grouped by access specifier
for (dir, ports) in opts.tcp {
let mut access = BitFlags::empty();
if dir.inbound {
access.insert(make_bitflags!(AccessNet::BindTcp));
}
if dir.outbound {
access.insert(make_bitflags!(AccessNet::ConnectTcp))
}
for port in ports {
ruleset = ruleset
.add_rule(NetPort::new(port, access))
.context("adding tcp rule")?;
if abi >= ABI::V3 {
for (dir, ports) in opts.tcp {
let mut access = BitFlags::empty();
if dir.inbound {
access.insert(make_bitflags!(AccessNet::BindTcp));
}
if dir.outbound {
access.insert(make_bitflags!(AccessNet::ConnectTcp))
}
for port in ports {
ruleset = ruleset
.add_rule(NetPort::new(port, access))
.context("adding tcp rule")?;
}
}
} else if !opts.tcp.is_empty() {
return Err(anyhow!(
"tcp controls are only supported with Landlock ABI 3 or higher"
));
}
// locate our executable
#[cfg(feature = "which")]
#[cfg(feature = "cli")]
let fullpath = which::which(&opts.exec[0]).context("finding executable")?;
#[cfg(not(feature = "which"))]
#[cfg(not(feature = "cli"))]
let fullpath = &opts.exec[0];
// add executeable as read+execute
if !opts.unsandbox.fs {
ruleset = ruleset.add_rules(path_beneath_rules(
std::slice::from_ref(&fullpath),
AccessFs::from_read(ABI::V6),
AccessFs::from_read(abi),
))?;
}
// if requested, trace dependencies and add as read+execute
#[cfg(feature = "ldd")]
#[cfg(feature = "cli")]
if opts.ldd {
#[cfg(not(feature = "nix"))]
let loader = DynamicLoader::options()
.search_dirs(glibc::get_search_dirs(PathBuf::from_str("/")?)?)
.new_loader();
#[cfg(feature = "nix")]
let loader = DynamicLoader::options()
.search_dirs(glibc::get_hard_coded_search_dirs(None)?)
.new_loader();
let mut tree = DependencyTree::new();
let mut queue = VecDeque::new();
queue.push_back(fullpath.clone());
@ -201,7 +255,7 @@ examples
acc.extend(deps);
acc
}),
AccessFs::from_read(ABI::V6),
AccessFs::from_read(abi),
))
.context("tracking dependencies")?;
}

14
src/parse.rs
View file

@ -94,7 +94,7 @@ fn tcp_parse(pairs: &[String]) -> Result<HashMap<Direction, Vec<u16>>> {
Ok(rules)
}
pub fn parse_args() -> Result<Yoke> {
pub fn parse_args(args: impl Iterator<Item = String>) -> Result<Yoke> {
let mut yoke = Yoke::default();
let mut collector = Vec::new();
let mut cur_arg = Unset;
@ -109,7 +109,7 @@ pub fn parse_args() -> Result<Yoke> {
}
Ok(())
}
for mut arg in std::env::args().skip(1) {
for mut arg in args {
arg.make_ascii_lowercase();
match arg.as_str() {
"--fs" | "-f" => {
@ -146,7 +146,7 @@ pub fn parse_args() -> Result<Yoke> {
yoke.retain_env = true;
}
#[cfg(feature = "ldd")]
#[cfg(feature = "cli")]
"--ldd" | "-l" => {
collect_args(&mut yoke, &collector, &cur_arg)?;
collector.clear();
@ -166,13 +166,19 @@ pub fn parse_args() -> Result<Yoke> {
cur_arg = Unset;
yoke.unsandbox.tcp = true;
}
"--fd-args" | "-fd" => {
collect_args(&mut yoke, &collector, &cur_arg)?;
collector.clear();
cur_arg = Unset;
yoke.fd_args = true;
}
"--" => {
collect_args(&mut yoke, &collector, &cur_arg)?;
collector.clear();
cur_arg = Exec;
}
_ if cur_arg != Unset => {
collector.push(arg.clone());
collector.push(arg.to_string());
}
a => {
return Err(anyhow!("invalid argument: {}", a));

10
src/types.rs
View file

@ -1,3 +1,4 @@
use anyhow::Result;
use std::{collections::HashMap, path::PathBuf};
#[derive(Debug, Default)]
@ -16,6 +17,7 @@ pub struct Yoke {
pub sockets: bool,
pub unsandbox: Unsandbox,
pub ldd: bool,
pub fd_args: bool,
pub exec: Vec<String>,
}
@ -32,3 +34,11 @@ pub struct Direction {
pub inbound: bool,
pub outbound: bool,
}
impl Yoke {
pub fn merge(&mut self, other: Yoke) {
self.fs.extend(other.fs);
self.tcp.extend(other.tcp);
self.env.extend(other.env);
}
}