From e032d6b4a58ef108e362e5aa6796b56ccda32e27 Mon Sep 17 00:00:00 2001 From: Skye Soss Date: Sat, 18 Jul 2026 13:26:53 -0500 Subject: [PATCH] setpriv: error when a landlock rule has no access The --landlock-rule option is used to allow operations through the restriction introduced by a --landlock-access option. Specifying --landlock-rule without specifying the corresponding --landlock-access is always a user error, so produce an error message when that happens. Signed-off-by: Skye Soss --- sys-utils/setpriv-landlock.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/sys-utils/setpriv-landlock.c b/sys-utils/setpriv-landlock.c index e95fedd0f..aeaf1b12f 100644 --- a/sys-utils/setpriv-landlock.c +++ b/sys-utils/setpriv-landlock.c @@ -224,6 +224,14 @@ void do_landlock(const struct setpriv_landlock_opts *opts) struct list_head *entry; int fd, ret; + list_for_each(entry, &opts->rules) { + rule = list_entry(entry, struct landlock_rule_entry, head); + if (rule->rule_type == LANDLOCK_RULE_PATH_BENEATH && !opts->access_fs) { + errx(EXIT_FAILURE, + _("landlock path-beneath rule requires a filesystem access restriction (--landlock-access fs)")); + } + } + if (!opts->access_fs) return; -- 2.47.3