From: Skye Soss <skye@soss.website>
Date: Sat, 18 Jul 2026 18:26:53 +0000 (-0500)
Subject: setpriv: error when a landlock rule has no access
X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=e032d6b4a58ef108e362e5aa6796b56ccda32e27;p=thirdparty%2Futil-linux.git

setpriv: error when a landlock rule has no access

The --landlock-rule option is used to allow operations through the
restriction introduced by a --landlock-access option. Specifying
--landlock-rule without specifying the corresponding --landlock-access
is always a user error, so produce an error message when that happens.

Signed-off-by: Skye Soss <skye@soss.website>
---

diff --git a/sys-utils/setpriv-landlock.c b/sys-utils/setpriv-landlock.c
index e95fedd0f..aeaf1b12f 100644
--- a/sys-utils/setpriv-landlock.c
+++ b/sys-utils/setpriv-landlock.c
@@ -224,6 +224,14 @@ void do_landlock(const struct setpriv_landlock_opts *opts)
 	struct list_head *entry;
 	int fd, ret;
 
+	list_for_each(entry, &opts->rules) {
+		rule = list_entry(entry, struct landlock_rule_entry, head);
+		if (rule->rule_type == LANDLOCK_RULE_PATH_BENEATH && !opts->access_fs) {
+			errx(EXIT_FAILURE,
+				_("landlock path-beneath rule requires a filesystem access restriction (--landlock-access fs)"));
+		}
+	}
+
 	if (!opts->access_fs)
 		return;