rework features, add abi support, add fd args
This commit is contained in:
atagen
parent
ab083b07e4
commit
2341a204bb
6 changed files with 176 additions and 63 deletions
122
src/main.rs
122
src/main.rs
|
|
@ -7,13 +7,26 @@ use landlock::{
|
|||
RulesetCreatedAttr, Scope, make_bitflags, path_beneath_rules,
|
||||
};
|
||||
|
||||
#[cfg(feature = "ldd")]
|
||||
#[cfg(feature = "cli")]
|
||||
use elb_dl::{DependencyTree, DynamicLoader, glibc};
|
||||
#[cfg(feature = "ldd")]
|
||||
#[cfg(feature = "cli")]
|
||||
use std::{collections::VecDeque, path::PathBuf, str::FromStr};
|
||||
use std::{fs::File, io::Read, os::fd::FromRawFd};
|
||||
|
||||
fn main() -> Result<()> {
|
||||
let opts = parse::parse_args()?;
|
||||
let args = std::env::args().skip(1);
|
||||
let mut opts = parse::parse_args(args)?;
|
||||
if opts.fd_args {
|
||||
let mut fd = unsafe { File::from_raw_fd(3) };
|
||||
let mut raw_args = String::new();
|
||||
fd.read_to_string(&mut raw_args)?;
|
||||
let args = raw_args
|
||||
.split_ascii_whitespace()
|
||||
.map(|s| s.to_string())
|
||||
.collect::<Vec<String>>();
|
||||
let fd_opts = parse::parse_args(args.into_iter())?;
|
||||
opts.merge(fd_opts);
|
||||
}
|
||||
if opts.exec.is_empty() {
|
||||
// print help
|
||||
eprintln!(
|
||||
|
|
@ -33,8 +46,8 @@ rules
|
|||
env vars:
|
||||
--env | -e [key]=[value]
|
||||
|
||||
clear inherited env vars:
|
||||
--clear-env | -c
|
||||
retain inherited env vars:
|
||||
--retain-env | -r
|
||||
|
||||
allow use of external unix domain sockets:
|
||||
--sockets | -s
|
||||
|
|
@ -50,6 +63,9 @@ rules
|
|||
--no-fs | -nf
|
||||
--no-tcp | -nt
|
||||
|
||||
accept additional rules from fd 3:
|
||||
--fd-args | -fd
|
||||
|
||||
|
||||
access specifiers
|
||||
------------
|
||||
|
|
@ -77,16 +93,26 @@ examples
|
|||
// set up scope of our intial ruleset
|
||||
let mut preempt = Ruleset::default();
|
||||
|
||||
// TODO FIXME set up for lesser ABI versions
|
||||
preempt = preempt.set_compatibility(landlock::CompatLevel::HardRequirement);
|
||||
|
||||
#[cfg(feature = "abi-2")]
|
||||
let abi = ABI::V2;
|
||||
#[cfg(feature = "abi-3")]
|
||||
let abi = ABI::V3;
|
||||
#[cfg(feature = "abi-4")]
|
||||
let abi = ABI::V4;
|
||||
#[cfg(feature = "abi-5")]
|
||||
let abi = ABI::V5;
|
||||
#[cfg(feature = "abi-6")]
|
||||
let abi = ABI::V6;
|
||||
|
||||
// disallow signals to other processes
|
||||
if !opts.signals {
|
||||
if !opts.signals && abi >= ABI::V6 {
|
||||
preempt = preempt.scope(Scope::Signal).context("scoping signals")?;
|
||||
}
|
||||
|
||||
// disallow connections to unix domain sockets
|
||||
if !opts.sockets {
|
||||
if !opts.sockets && abi >= ABI::V6 {
|
||||
preempt = preempt
|
||||
.scope(Scope::AbstractUnixSocket)
|
||||
.context("scoping sockets")?;
|
||||
|
|
@ -95,14 +121,14 @@ examples
|
|||
// lock down fs access
|
||||
preempt = if !opts.unsandbox.fs {
|
||||
preempt
|
||||
.handle_access(AccessFs::from_all(ABI::V6))
|
||||
.handle_access(AccessFs::from_all(abi))
|
||||
.context("handling fs access")?
|
||||
} else {
|
||||
preempt
|
||||
};
|
||||
|
||||
// lock down tcp access
|
||||
preempt = if !opts.unsandbox.tcp {
|
||||
preempt = if !(opts.unsandbox.tcp || abi < ABI::V3) {
|
||||
preempt
|
||||
.handle_access(AccessNet::BindTcp)
|
||||
.context("handling tcp bind access")?
|
||||
|
|
@ -122,8 +148,9 @@ examples
|
|||
access.insert(make_bitflags!(AccessFs::{ReadFile | ReadDir}));
|
||||
}
|
||||
if perms.write {
|
||||
access.insert(make_bitflags!(
|
||||
AccessFs::{ WriteFile
|
||||
let mut flags = make_bitflags!(
|
||||
AccessFs::{
|
||||
WriteFile
|
||||
| RemoveDir
|
||||
| RemoveFile
|
||||
| MakeChar
|
||||
|
|
@ -133,19 +160,33 @@ examples
|
|||
| MakeFifo
|
||||
| MakeBlock
|
||||
| MakeSym
|
||||
| Refer
|
||||
| Truncate
|
||||
}
|
||||
));
|
||||
);
|
||||
match abi {
|
||||
ABI::V2 => {
|
||||
flags.insert(AccessFs::Refer);
|
||||
}
|
||||
_ if abi >= ABI::V3 => {
|
||||
flags.insert(AccessFs::Refer | AccessFs::Truncate);
|
||||
}
|
||||
_ => (),
|
||||
};
|
||||
access.insert(flags);
|
||||
}
|
||||
if perms.execute {
|
||||
access.insert(AccessFs::Execute);
|
||||
}
|
||||
if perms.ioctl {
|
||||
access.insert(AccessFs::IoctlDev);
|
||||
if abi >= ABI::V6 {
|
||||
access.insert(AccessFs::IoctlDev);
|
||||
} else {
|
||||
return Err(anyhow!(
|
||||
"ioctl is only available on Landlock ABI 6 or higher"
|
||||
));
|
||||
}
|
||||
}
|
||||
if access == BitFlags::empty() {
|
||||
return Err(anyhow!("invalid filesystem permissions requested"));
|
||||
return Err(anyhow!("invalid/empty filesystem permissions requested"));
|
||||
}
|
||||
ruleset = ruleset
|
||||
.add_rules(path_beneath_rules(paths, access))
|
||||
|
|
@ -153,41 +194,54 @@ examples
|
|||
}
|
||||
|
||||
// allow each tcp action specified, grouped by access specifier
|
||||
for (dir, ports) in opts.tcp {
|
||||
let mut access = BitFlags::empty();
|
||||
if dir.inbound {
|
||||
access.insert(make_bitflags!(AccessNet::BindTcp));
|
||||
}
|
||||
if dir.outbound {
|
||||
access.insert(make_bitflags!(AccessNet::ConnectTcp))
|
||||
}
|
||||
for port in ports {
|
||||
ruleset = ruleset
|
||||
.add_rule(NetPort::new(port, access))
|
||||
.context("adding tcp rule")?;
|
||||
if abi >= ABI::V3 {
|
||||
for (dir, ports) in opts.tcp {
|
||||
let mut access = BitFlags::empty();
|
||||
if dir.inbound {
|
||||
access.insert(make_bitflags!(AccessNet::BindTcp));
|
||||
}
|
||||
if dir.outbound {
|
||||
access.insert(make_bitflags!(AccessNet::ConnectTcp))
|
||||
}
|
||||
for port in ports {
|
||||
ruleset = ruleset
|
||||
.add_rule(NetPort::new(port, access))
|
||||
.context("adding tcp rule")?;
|
||||
}
|
||||
}
|
||||
} else if !opts.tcp.is_empty() {
|
||||
return Err(anyhow!(
|
||||
"tcp controls are only supported with Landlock ABI 3 or higher"
|
||||
));
|
||||
}
|
||||
|
||||
// locate our executable
|
||||
#[cfg(feature = "which")]
|
||||
#[cfg(feature = "cli")]
|
||||
let fullpath = which::which(&opts.exec[0]).context("finding executable")?;
|
||||
#[cfg(not(feature = "which"))]
|
||||
#[cfg(not(feature = "cli"))]
|
||||
let fullpath = &opts.exec[0];
|
||||
|
||||
// add executeable as read+execute
|
||||
if !opts.unsandbox.fs {
|
||||
ruleset = ruleset.add_rules(path_beneath_rules(
|
||||
std::slice::from_ref(&fullpath),
|
||||
AccessFs::from_read(ABI::V6),
|
||||
AccessFs::from_read(abi),
|
||||
))?;
|
||||
}
|
||||
|
||||
// if requested, trace dependencies and add as read+execute
|
||||
#[cfg(feature = "ldd")]
|
||||
#[cfg(feature = "cli")]
|
||||
if opts.ldd {
|
||||
#[cfg(not(feature = "nix"))]
|
||||
let loader = DynamicLoader::options()
|
||||
.search_dirs(glibc::get_search_dirs(PathBuf::from_str("/")?)?)
|
||||
.new_loader();
|
||||
|
||||
#[cfg(feature = "nix")]
|
||||
let loader = DynamicLoader::options()
|
||||
.search_dirs(glibc::get_hard_coded_search_dirs(None)?)
|
||||
.new_loader();
|
||||
|
||||
let mut tree = DependencyTree::new();
|
||||
let mut queue = VecDeque::new();
|
||||
queue.push_back(fullpath.clone());
|
||||
|
|
@ -201,7 +255,7 @@ examples
|
|||
acc.extend(deps);
|
||||
acc
|
||||
}),
|
||||
AccessFs::from_read(ABI::V6),
|
||||
AccessFs::from_read(abi),
|
||||
))
|
||||
.context("tracking dependencies")?;
|
||||
}
|
||||
|
|
|
|||
14
src/parse.rs
14
src/parse.rs
|
|
@ -94,7 +94,7 @@ fn tcp_parse(pairs: &[String]) -> Result<HashMap<Direction, Vec<u16>>> {
|
|||
Ok(rules)
|
||||
}
|
||||
|
||||
pub fn parse_args() -> Result<Yoke> {
|
||||
pub fn parse_args(args: impl Iterator<Item = String>) -> Result<Yoke> {
|
||||
let mut yoke = Yoke::default();
|
||||
let mut collector = Vec::new();
|
||||
let mut cur_arg = Unset;
|
||||
|
|
@ -109,7 +109,7 @@ pub fn parse_args() -> Result<Yoke> {
|
|||
}
|
||||
Ok(())
|
||||
}
|
||||
for mut arg in std::env::args().skip(1) {
|
||||
for mut arg in args {
|
||||
arg.make_ascii_lowercase();
|
||||
match arg.as_str() {
|
||||
"--fs" | "-f" => {
|
||||
|
|
@ -146,7 +146,7 @@ pub fn parse_args() -> Result<Yoke> {
|
|||
yoke.retain_env = true;
|
||||
}
|
||||
|
||||
#[cfg(feature = "ldd")]
|
||||
#[cfg(feature = "cli")]
|
||||
"--ldd" | "-l" => {
|
||||
collect_args(&mut yoke, &collector, &cur_arg)?;
|
||||
collector.clear();
|
||||
|
|
@ -166,13 +166,19 @@ pub fn parse_args() -> Result<Yoke> {
|
|||
cur_arg = Unset;
|
||||
yoke.unsandbox.tcp = true;
|
||||
}
|
||||
"--fd-args" | "-fd" => {
|
||||
collect_args(&mut yoke, &collector, &cur_arg)?;
|
||||
collector.clear();
|
||||
cur_arg = Unset;
|
||||
yoke.fd_args = true;
|
||||
}
|
||||
"--" => {
|
||||
collect_args(&mut yoke, &collector, &cur_arg)?;
|
||||
collector.clear();
|
||||
cur_arg = Exec;
|
||||
}
|
||||
_ if cur_arg != Unset => {
|
||||
collector.push(arg.clone());
|
||||
collector.push(arg.to_string());
|
||||
}
|
||||
a => {
|
||||
return Err(anyhow!("invalid argument: {}", a));
|
||||
|
|
|
|||
10
src/types.rs
10
src/types.rs
|
|
@ -1,3 +1,4 @@
|
|||
use anyhow::Result;
|
||||
use std::{collections::HashMap, path::PathBuf};
|
||||
|
||||
#[derive(Debug, Default)]
|
||||
|
|
@ -16,6 +17,7 @@ pub struct Yoke {
|
|||
pub sockets: bool,
|
||||
pub unsandbox: Unsandbox,
|
||||
pub ldd: bool,
|
||||
pub fd_args: bool,
|
||||
pub exec: Vec<String>,
|
||||
}
|
||||
|
||||
|
|
@ -32,3 +34,11 @@ pub struct Direction {
|
|||
pub inbound: bool,
|
||||
pub outbound: bool,
|
||||
}
|
||||
|
||||
impl Yoke {
|
||||
pub fn merge(&mut self, other: Yoke) {
|
||||
self.fs.extend(other.fs);
|
||||
self.tcp.extend(other.tcp);
|
||||
self.env.extend(other.env);
|
||||
}
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue