From: Skye Soss Date: Sat, 18 Jul 2026 18:20:00 +0000 (-0500) Subject: setpriv: add resolve-unix filesystem access option X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=747e21096dde0f71dbb77db72a133cfe951dfd7d;p=thirdparty%2Futil-linux.git setpriv: add resolve-unix filesystem access option The LANDLOCK_ACCESS_FS_RESOLVE_UNIX option is supported by Landlock ABI version 9, which was added in Linux 7.1. Signed-off-by: Skye Soss --- diff --git a/sys-utils/setpriv-landlock.c b/sys-utils/setpriv-landlock.c index f0b9087a0..e95fedd0f 100644 --- a/sys-utils/setpriv-landlock.c +++ b/sys-utils/setpriv-landlock.c @@ -51,6 +51,7 @@ struct landlock_path_beneath_attr { #define LANDLOCK_ACCESS_FS_REFER (1ULL << 13) #define LANDLOCK_ACCESS_FS_TRUNCATE (1ULL << 14) #define LANDLOCK_ACCESS_FS_IOCTL_DEV (1ULL << 15) +#define LANDLOCK_ACCESS_FS_RESOLVE_UNIX (1ULL << 16) static inline int landlock_create_ruleset( const struct landlock_ruleset_attr *attr, @@ -87,22 +88,23 @@ static const struct { const char *type; const char *help; } landlock_access_fs[] = { - { LANDLOCK_ACCESS_FS_EXECUTE, "execute", N_("execute a file") }, - { LANDLOCK_ACCESS_FS_WRITE_FILE, "write-file", N_("open a file with write access") }, - { LANDLOCK_ACCESS_FS_READ_FILE, "read-file", N_("open a file with read access") }, - { LANDLOCK_ACCESS_FS_READ_DIR, "read-dir", N_("open a directory or list its content") }, - { LANDLOCK_ACCESS_FS_REMOVE_DIR, "remove-dir", N_("remove an empty directory or rename one") }, - { LANDLOCK_ACCESS_FS_REMOVE_FILE, "remove-file", N_("unlink (or rename) a file") }, - { LANDLOCK_ACCESS_FS_MAKE_CHAR, "make-char", N_("create (or rename or link) a character device") }, - { LANDLOCK_ACCESS_FS_MAKE_DIR, "make-dir", N_("create (or rename) a directory") }, - { LANDLOCK_ACCESS_FS_MAKE_REG, "make-reg", N_("create (or rename or link) a regular file") }, - { LANDLOCK_ACCESS_FS_MAKE_SOCK, "make-sock", N_("create (or rename or link) a UNIX domain socket") }, - { LANDLOCK_ACCESS_FS_MAKE_FIFO, "make-fifo", N_("create (or rename or link) a named pipe") }, - { LANDLOCK_ACCESS_FS_MAKE_BLOCK, "make-block", N_("create (or rename or link) a block device") }, - { LANDLOCK_ACCESS_FS_MAKE_SYM, "make-sym", N_("create (or rename or link) a symbolic link") }, - { LANDLOCK_ACCESS_FS_REFER, "refer", N_("link or rename a file from or to a different directory") }, - { LANDLOCK_ACCESS_FS_TRUNCATE, "truncate", N_("truncate a file with truncate(2)") }, - { LANDLOCK_ACCESS_FS_IOCTL_DEV, "ioctl-dev", N_("invoke ioctl(2) on an opened character or block device") }, + { LANDLOCK_ACCESS_FS_EXECUTE, "execute", N_("execute a file") }, + { LANDLOCK_ACCESS_FS_WRITE_FILE, "write-file", N_("open a file with write access") }, + { LANDLOCK_ACCESS_FS_READ_FILE, "read-file", N_("open a file with read access") }, + { LANDLOCK_ACCESS_FS_READ_DIR, "read-dir", N_("open a directory or list its content") }, + { LANDLOCK_ACCESS_FS_REMOVE_DIR, "remove-dir", N_("remove an empty directory or rename one") }, + { LANDLOCK_ACCESS_FS_REMOVE_FILE, "remove-file", N_("unlink (or rename) a file") }, + { LANDLOCK_ACCESS_FS_MAKE_CHAR, "make-char", N_("create (or rename or link) a character device") }, + { LANDLOCK_ACCESS_FS_MAKE_DIR, "make-dir", N_("create (or rename) a directory") }, + { LANDLOCK_ACCESS_FS_MAKE_REG, "make-reg", N_("create (or rename or link) a regular file") }, + { LANDLOCK_ACCESS_FS_MAKE_SOCK, "make-sock", N_("create (or rename or link) a UNIX domain socket") }, + { LANDLOCK_ACCESS_FS_MAKE_FIFO, "make-fifo", N_("create (or rename or link) a named pipe") }, + { LANDLOCK_ACCESS_FS_MAKE_BLOCK, "make-block", N_("create (or rename or link) a block device") }, + { LANDLOCK_ACCESS_FS_MAKE_SYM, "make-sym", N_("create (or rename or link) a symbolic link") }, + { LANDLOCK_ACCESS_FS_REFER, "refer", N_("link or rename a file from or to a different directory") }, + { LANDLOCK_ACCESS_FS_TRUNCATE, "truncate", N_("truncate a file with truncate(2)") }, + { LANDLOCK_ACCESS_FS_IOCTL_DEV, "ioctl-dev", N_("invoke ioctl(2) on an opened character or block device") }, + { LANDLOCK_ACCESS_FS_RESOLVE_UNIX, "resolve-unix", N_("connect(2) or bind(2) a pathname UNIX domain socket") }, }; /* cumulative access_fs rights supported by each landlock ABI version, indexed by (abi - 1) */ @@ -112,6 +114,10 @@ static const uint64_t landlock_access_fs_mask[] = { /* ABI 3 */ (LANDLOCK_ACCESS_FS_TRUNCATE << 1) - 1, /* ABI 4 */ (LANDLOCK_ACCESS_FS_TRUNCATE << 1) - 1, /* ABI 5 */ (LANDLOCK_ACCESS_FS_IOCTL_DEV << 1) - 1, + /* ABI 6 */ (LANDLOCK_ACCESS_FS_IOCTL_DEV << 1) - 1, + /* ABI 7 */ (LANDLOCK_ACCESS_FS_IOCTL_DEV << 1) - 1, + /* ABI 8 */ (LANDLOCK_ACCESS_FS_IOCTL_DEV << 1) - 1, + /* ABI 9 */ (LANDLOCK_ACCESS_FS_RESOLVE_UNIX << 1) - 1, }; static int supported_landlock_abi(void)