setpriv: error when a landlock rule has no access

The --landlock-rule option is used to allow operations through the
restriction introduced by a --landlock-access option. Specifying
--landlock-rule without specifying the corresponding --landlock-access
is always a user error, so produce an error message when that happens.

Signed-off-by: Skye Soss <skye@soss.website>

diff --git a/sys-utils/setpriv-landlock.c b/sys-utils/setpriv-landlock.c
index e95fedd0f76906353d09f4d89305f8f028441de9..aeaf1b12f4a4997f27697153312a22747cad80d7 100644 (file)
--- a/sys-utils/setpriv-landlock.c
+++ b/sys-utils/setpriv-landlock.c
@@ -224,6 +224,14 @@ void do_landlock(const struct setpriv_landlock_opts *opts)
        struct list_head *entry;
        int fd, ret;
 
+       list_for_each(entry, &opts->rules) {
+               rule = list_entry(entry, struct landlock_rule_entry, head);
+               if (rule->rule_type == LANDLOCK_RULE_PATH_BENEATH && !opts->access_fs) {
+                       errx(EXIT_FAILURE,
+                               _("landlock path-beneath rule requires a filesystem access restriction (--landlock-access fs)"));
+               }
+       }
+
        if (!opts->access_fs)
                return;