xzdec: Use my_landlock.h

diff --git a/CMakeLists.txt b/CMakeLists.txt
index f5a98fa1b0772dbf4940e547bbbe430ec6a21bd5..3091eca37718fc0231c4fe9885c9e8d7a107a50d 100644 (file)
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1940,6 +1940,7 @@ if(HAVE_DECODERS)
 
     foreach(XZDEC ${XZDEC_TOOLS})
         add_executable("${XZDEC}"
+            src/common/my_landlock.h
             src/common/sysdefs.h
             src/common/tuklib_common.h
             src/common/tuklib_config.h

diff --git a/src/xzdec/xzdec.c b/src/xzdec/xzdec.c
index 00c2f66e4a787f279f164ce7fd58403e307f42de..2a63ab58a25c786b691fa86f710168ce98aa72e1 100644 (file)
--- a/src/xzdec/xzdec.c
+++ b/src/xzdec/xzdec.c
@@ -26,14 +26,7 @@
 #endif
 
 #ifdef HAVE_LINUX_LANDLOCK
-#      include <linux/landlock.h>
-#      include <sys/prctl.h>
-#      include <sys/syscall.h>
-#      ifdef LANDLOCK_ACCESS_NET_BIND_TCP
-#              define LANDLOCK_ABI_MAX 4
-#      else
-#              define LANDLOCK_ABI_MAX 3
-#      endif
+#      include "my_landlock.h"
 #endif
 
 #if defined(HAVE_CAP_RIGHTS_LIMIT) || defined(HAVE_PLEDGE) \
@@ -338,32 +331,17 @@ sandbox_enter(int src_fd)
        (void)src_fd;
 
 #elif defined(HAVE_LINUX_LANDLOCK)
-       int landlock_abi = syscall(SYS_landlock_create_ruleset,
-                       (void *)NULL, 0, LANDLOCK_CREATE_RULESET_VERSION);
-
-       if (landlock_abi > 0) {
-               if (landlock_abi > LANDLOCK_ABI_MAX)
-                       landlock_abi = LANDLOCK_ABI_MAX;
-
-               const struct landlock_ruleset_attr attr = {
-                       .handled_access_fs = (1ULL
-                               << (12 + my_min(3, landlock_abi))) - 1,
-#      if LANDLOCK_ABI_MAX >= 4
-                       .handled_access_net = landlock_abi < 4 ? 0 :
-                               (LANDLOCK_ACCESS_NET_BIND_TCP
-                               | LANDLOCK_ACCESS_NET_CONNECT_TCP),
-#      endif
-               };
-
-               const int ruleset_fd = syscall(SYS_landlock_create_ruleset,
-                               &attr, sizeof(attr), 0U);
+       struct landlock_ruleset_attr attr;
+       if (my_landlock_ruleset_attr_forbid_all(&attr) > 0) {
+               const int ruleset_fd = my_landlock_create_ruleset(
+                               &attr, sizeof(attr), 0);
                if (ruleset_fd < 0)
                        goto error;
 
                // All files we need should have already been opened. Thus,
                // we don't need to add any rules using landlock_add_rule(2)
                // before activating the sandbox.
-               if (syscall(SYS_landlock_restrict_self, ruleset_fd, 0U) != 0)
+               if (my_landlock_restrict_self(ruleset_fd, 0) != 0)
                        goto error;
        }