libalpm: Capitalize "Landlock" as suggested by Mickaël Salaün
This commit is contained in:
parent
1941b3d3f5
commit
46504eea65
1 changed files with 11 additions and 11 deletions
|
@ -110,39 +110,39 @@ bool _alpm_sandbox_fs_restrict_writes_to(alpm_handle_t *handle, const char *path
|
||||||
|
|
||||||
abi = landlock_create_ruleset(NULL, 0, LANDLOCK_CREATE_RULESET_VERSION);
|
abi = landlock_create_ruleset(NULL, 0, LANDLOCK_CREATE_RULESET_VERSION);
|
||||||
if(abi < 0) {
|
if(abi < 0) {
|
||||||
/* landlock is not supported/enabled in the kernel */
|
/* Landlock is not supported/enabled in the kernel */
|
||||||
_alpm_log(handle, ALPM_LOG_ERROR, _("restricting filesystem access failed because landlock is not supported by the kernel!\n"));
|
_alpm_log(handle, ALPM_LOG_ERROR, _("restricting filesystem access failed because Landlock is not supported by the kernel!\n"));
|
||||||
return true;
|
return true;
|
||||||
}
|
}
|
||||||
#ifdef LANDLOCK_ACCESS_FS_REFER
|
#ifdef LANDLOCK_ACCESS_FS_REFER
|
||||||
if(abi < 2) {
|
if(abi < 2) {
|
||||||
_alpm_log(handle, ALPM_LOG_DEBUG, _("landlock ABI < 2, LANDLOCK_ACCESS_FS_REFER is not supported\n"));
|
_alpm_log(handle, ALPM_LOG_DEBUG, _("Landlock ABI < 2, LANDLOCK_ACCESS_FS_REFER is not supported\n"));
|
||||||
ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_REFER;
|
ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_REFER;
|
||||||
}
|
}
|
||||||
#endif /* LANDLOCK_ACCESS_FS_REFER */
|
#endif /* LANDLOCK_ACCESS_FS_REFER */
|
||||||
#ifdef LANDLOCK_ACCESS_FS_TRUNCATE
|
#ifdef LANDLOCK_ACCESS_FS_TRUNCATE
|
||||||
if(abi < 3) {
|
if(abi < 3) {
|
||||||
_alpm_log(handle, ALPM_LOG_DEBUG, _("landlock ABI < 3, LANDLOCK_ACCESS_FS_TRUNCATE is not supported\n"));
|
_alpm_log(handle, ALPM_LOG_DEBUG, _("Landlock ABI < 3, LANDLOCK_ACCESS_FS_TRUNCATE is not supported\n"));
|
||||||
ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_TRUNCATE;
|
ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_TRUNCATE;
|
||||||
}
|
}
|
||||||
#endif /* LANDLOCK_ACCESS_FS_TRUNCATE */
|
#endif /* LANDLOCK_ACCESS_FS_TRUNCATE */
|
||||||
|
|
||||||
ruleset_fd = landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
|
ruleset_fd = landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
|
||||||
if(ruleset_fd < 0) {
|
if(ruleset_fd < 0) {
|
||||||
_alpm_log(handle, ALPM_LOG_ERROR, _("restricting filesystem access failed because the landlock ruleset could not be created: %s\n"), strerror(errno));
|
_alpm_log(handle, ALPM_LOG_ERROR, _("restricting filesystem access failed because the Landlock ruleset could not be created: %s\n"), strerror(errno));
|
||||||
return false;
|
return false;
|
||||||
}
|
}
|
||||||
|
|
||||||
/* allow / as read-only */
|
/* allow / as read-only */
|
||||||
path_beneath.parent_fd = open("/", O_PATH | O_CLOEXEC | O_DIRECTORY);
|
path_beneath.parent_fd = open("/", O_PATH | O_CLOEXEC | O_DIRECTORY);
|
||||||
if(path_beneath.parent_fd == -1) {
|
if(path_beneath.parent_fd == -1) {
|
||||||
_alpm_log(handle, ALPM_LOG_ERROR, _("opening the root filesystem to make it read-only via landlock failed: %s\n"), strerror(errno));
|
_alpm_log(handle, ALPM_LOG_ERROR, _("opening the root filesystem to make it read-only via Landlock failed: %s\n"), strerror(errno));
|
||||||
return false;
|
return false;
|
||||||
}
|
}
|
||||||
path_beneath.allowed_access = _LANDLOCK_ACCESS_FS_READ;
|
path_beneath.allowed_access = _LANDLOCK_ACCESS_FS_READ;
|
||||||
|
|
||||||
if(landlock_add_rule(ruleset_fd, LANDLOCK_RULE_PATH_BENEATH, &path_beneath, 0) != 0) {
|
if(landlock_add_rule(ruleset_fd, LANDLOCK_RULE_PATH_BENEATH, &path_beneath, 0) != 0) {
|
||||||
_alpm_log(handle, ALPM_LOG_ERROR, _("restricting filesystem access failed because the landlock rule for / could not be added: %s\n"), strerror(errno));
|
_alpm_log(handle, ALPM_LOG_ERROR, _("restricting filesystem access failed because the Landlock rule for / could not be added: %s\n"), strerror(errno));
|
||||||
close(path_beneath.parent_fd);
|
close(path_beneath.parent_fd);
|
||||||
close(ruleset_fd);
|
close(ruleset_fd);
|
||||||
return false;
|
return false;
|
||||||
|
@ -153,7 +153,7 @@ bool _alpm_sandbox_fs_restrict_writes_to(alpm_handle_t *handle, const char *path
|
||||||
/* allow read-write access to the directory passed as parameter */
|
/* allow read-write access to the directory passed as parameter */
|
||||||
path_beneath.parent_fd = open(path, O_PATH | O_CLOEXEC | O_DIRECTORY);
|
path_beneath.parent_fd = open(path, O_PATH | O_CLOEXEC | O_DIRECTORY);
|
||||||
if(path_beneath.parent_fd == -1) {
|
if(path_beneath.parent_fd == -1) {
|
||||||
_alpm_log(handle, ALPM_LOG_ERROR, _("opening the download directory to make it writable via landlock failed: %s\n"), strerror(errno));
|
_alpm_log(handle, ALPM_LOG_ERROR, _("opening the download directory to make it writable via Landlock failed: %s\n"), strerror(errno));
|
||||||
return false;
|
return false;
|
||||||
}
|
}
|
||||||
path_beneath.allowed_access = _LANDLOCK_ACCESS_FS_READ | _LANDLOCK_ACCESS_FS_WRITE | _LANDLOCK_ACCESS_FS_TRUNCATE;
|
path_beneath.allowed_access = _LANDLOCK_ACCESS_FS_READ | _LANDLOCK_ACCESS_FS_WRITE | _LANDLOCK_ACCESS_FS_TRUNCATE;
|
||||||
|
@ -164,17 +164,17 @@ bool _alpm_sandbox_fs_restrict_writes_to(alpm_handle_t *handle, const char *path
|
||||||
if(landlock_add_rule(ruleset_fd, LANDLOCK_RULE_PATH_BENEATH, &path_beneath, 0) == 0) {
|
if(landlock_add_rule(ruleset_fd, LANDLOCK_RULE_PATH_BENEATH, &path_beneath, 0) == 0) {
|
||||||
if(landlock_restrict_self(ruleset_fd, 0)) {
|
if(landlock_restrict_self(ruleset_fd, 0)) {
|
||||||
result = errno;
|
result = errno;
|
||||||
_alpm_log(handle, ALPM_LOG_ERROR, _("restricting filesystem access failed because the landlock ruleset could not be applied: %s\n"), strerror(result));
|
_alpm_log(handle, ALPM_LOG_ERROR, _("restricting filesystem access failed because the Landlock ruleset could not be applied: %s\n"), strerror(result));
|
||||||
}
|
}
|
||||||
} else {
|
} else {
|
||||||
result = errno;
|
result = errno;
|
||||||
_alpm_log(handle, ALPM_LOG_ERROR, _("restricting filesystem access failed because the landlock rule for the temporary download directory could not be added: %s\n"), strerror(result));
|
_alpm_log(handle, ALPM_LOG_ERROR, _("restricting filesystem access failed because the Landlock rule for the temporary download directory could not be added: %s\n"), strerror(result));
|
||||||
}
|
}
|
||||||
|
|
||||||
close(path_beneath.parent_fd);
|
close(path_beneath.parent_fd);
|
||||||
close(ruleset_fd);
|
close(ruleset_fd);
|
||||||
if(result == 0) {
|
if(result == 0) {
|
||||||
_alpm_log(handle, ALPM_LOG_DEBUG, _("filesystem access has been restricted to %s, landlock ABI is %d\n"), path, abi);
|
_alpm_log(handle, ALPM_LOG_DEBUG, _("filesystem access has been restricted to %s, Landlock ABI is %d\n"), path, abi);
|
||||||
return true;
|
return true;
|
||||||
}
|
}
|
||||||
return false;
|
return false;
|
||||||
|
|
Loading…
Add table
Reference in a new issue