setpriv: add resolve-unix filesystem access option

The LANDLOCK_ACCESS_FS_RESOLVE_UNIX option is supported by Landlock ABI
version 9, which was added in Linux 7.1.

Signed-off-by: Skye Soss <skye@soss.website>

diff --git a/sys-utils/setpriv-landlock.c b/sys-utils/setpriv-landlock.c
index f0b9087a081612a91f734dfc4d93a48e3e10b9e3..e95fedd0f76906353d09f4d89305f8f028441de9 100644 (file)
--- a/sys-utils/setpriv-landlock.c
+++ b/sys-utils/setpriv-landlock.c
@@ -51,6 +51,7 @@ struct landlock_path_beneath_attr {
 #define LANDLOCK_ACCESS_FS_REFER                       (1ULL << 13)
 #define LANDLOCK_ACCESS_FS_TRUNCATE                    (1ULL << 14)
 #define LANDLOCK_ACCESS_FS_IOCTL_DEV                   (1ULL << 15)
+#define LANDLOCK_ACCESS_FS_RESOLVE_UNIX                        (1ULL << 16)
 
 static inline int landlock_create_ruleset(
                const struct landlock_ruleset_attr *attr,
@@ -87,22 +88,23 @@ static const struct {
        const char *type;
        const char *help;
 } landlock_access_fs[] = {
-       { LANDLOCK_ACCESS_FS_EXECUTE,     "execute",     N_("execute a file") },
-       { LANDLOCK_ACCESS_FS_WRITE_FILE,  "write-file",  N_("open a file with write access") },
-       { LANDLOCK_ACCESS_FS_READ_FILE,   "read-file",   N_("open a file with read access") },
-       { LANDLOCK_ACCESS_FS_READ_DIR,    "read-dir",    N_("open a directory or list its content") },
-       { LANDLOCK_ACCESS_FS_REMOVE_DIR,  "remove-dir",  N_("remove an empty directory or rename one")  },
-       { LANDLOCK_ACCESS_FS_REMOVE_FILE, "remove-file", N_("unlink (or rename) a file") },
-       { LANDLOCK_ACCESS_FS_MAKE_CHAR,   "make-char",   N_("create (or rename or link) a character device") },
-       { LANDLOCK_ACCESS_FS_MAKE_DIR,    "make-dir",    N_("create (or rename) a directory") },
-       { LANDLOCK_ACCESS_FS_MAKE_REG,    "make-reg",    N_("create (or rename or link) a regular file") },
-       { LANDLOCK_ACCESS_FS_MAKE_SOCK,   "make-sock",   N_("create (or rename or link) a UNIX domain socket") },
-       { LANDLOCK_ACCESS_FS_MAKE_FIFO,   "make-fifo",   N_("create (or rename or link) a named pipe") },
-       { LANDLOCK_ACCESS_FS_MAKE_BLOCK,  "make-block",  N_("create (or rename or link) a block device") },
-       { LANDLOCK_ACCESS_FS_MAKE_SYM,    "make-sym",    N_("create (or rename or link) a symbolic link") },
-       { LANDLOCK_ACCESS_FS_REFER,       "refer",       N_("link or rename a file from or to a different directory") },
-       { LANDLOCK_ACCESS_FS_TRUNCATE,    "truncate",    N_("truncate a file with truncate(2)") },
-       { LANDLOCK_ACCESS_FS_IOCTL_DEV,   "ioctl-dev",   N_("invoke ioctl(2) on an opened character or block device") },
+       { LANDLOCK_ACCESS_FS_EXECUTE,      "execute",      N_("execute a file") },
+       { LANDLOCK_ACCESS_FS_WRITE_FILE,   "write-file",   N_("open a file with write access") },
+       { LANDLOCK_ACCESS_FS_READ_FILE,    "read-file",    N_("open a file with read access") },
+       { LANDLOCK_ACCESS_FS_READ_DIR,     "read-dir",     N_("open a directory or list its content") },
+       { LANDLOCK_ACCESS_FS_REMOVE_DIR,   "remove-dir",   N_("remove an empty directory or rename one")  },
+       { LANDLOCK_ACCESS_FS_REMOVE_FILE,  "remove-file",  N_("unlink (or rename) a file") },
+       { LANDLOCK_ACCESS_FS_MAKE_CHAR,    "make-char",    N_("create (or rename or link) a character device") },
+       { LANDLOCK_ACCESS_FS_MAKE_DIR,     "make-dir",     N_("create (or rename) a directory") },
+       { LANDLOCK_ACCESS_FS_MAKE_REG,     "make-reg",     N_("create (or rename or link) a regular file") },
+       { LANDLOCK_ACCESS_FS_MAKE_SOCK,    "make-sock",    N_("create (or rename or link) a UNIX domain socket") },
+       { LANDLOCK_ACCESS_FS_MAKE_FIFO,    "make-fifo",    N_("create (or rename or link) a named pipe") },
+       { LANDLOCK_ACCESS_FS_MAKE_BLOCK,   "make-block",   N_("create (or rename or link) a block device") },
+       { LANDLOCK_ACCESS_FS_MAKE_SYM,     "make-sym",     N_("create (or rename or link) a symbolic link") },
+       { LANDLOCK_ACCESS_FS_REFER,        "refer",        N_("link or rename a file from or to a different directory") },
+       { LANDLOCK_ACCESS_FS_TRUNCATE,     "truncate",     N_("truncate a file with truncate(2)") },
+       { LANDLOCK_ACCESS_FS_IOCTL_DEV,    "ioctl-dev",    N_("invoke ioctl(2) on an opened character or block device") },
+       { LANDLOCK_ACCESS_FS_RESOLVE_UNIX, "resolve-unix", N_("connect(2) or bind(2) a pathname UNIX domain socket") },
 };
 
 /* cumulative access_fs rights supported by each landlock ABI version, indexed by (abi - 1) */
@@ -112,6 +114,10 @@ static const uint64_t landlock_access_fs_mask[] = {
        /* ABI 3 */ (LANDLOCK_ACCESS_FS_TRUNCATE << 1) - 1,
        /* ABI 4 */ (LANDLOCK_ACCESS_FS_TRUNCATE << 1) - 1,
        /* ABI 5 */ (LANDLOCK_ACCESS_FS_IOCTL_DEV << 1) - 1,
+       /* ABI 6 */ (LANDLOCK_ACCESS_FS_IOCTL_DEV << 1) - 1,
+       /* ABI 7 */ (LANDLOCK_ACCESS_FS_IOCTL_DEV << 1) - 1,
+       /* ABI 8 */ (LANDLOCK_ACCESS_FS_IOCTL_DEV << 1) - 1,
+       /* ABI 9 */ (LANDLOCK_ACCESS_FS_RESOLVE_UNIX << 1) - 1,
 };
 
 static int supported_landlock_abi(void)