From 9af25400834aede88f1bc77b8524fcba10f15651 Mon Sep 17 00:00:00 2001 From: Collin Funk Date: Sat, 17 Oct 2026 21:36:10 -0700 Subject: [PATCH] Landlock: Support ABI version 10 Like TCP sockets, we do not need UDP sockets. Co-authored-by: Lasse Collin Closes: https://github.com/tukaani-project/xz/pull/257 --- src/common/my_landlock.h | 22 ++++++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-) diff --git a/src/common/my_landlock.h b/src/common/my_landlock.h index 35aee08e..faee21f3 100644 --- a/src/common/my_landlock.h +++ b/src/common/my_landlock.h @@ -46,6 +46,15 @@ # define LANDLOCK_ACCESS_FS_RESOLVE_UNIX (1ULL << 16) #endif +// handled_access_net was added in ABI version 4. Provide fallbacks +// for handled_access_net flags that were added in ABI version 10. +#ifndef LANDLOCK_ACCESS_NET_BIND_UDP +# define LANDLOCK_ACCESS_NET_BIND_UDP (1ULL << 2) +#endif +#ifndef LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP +# define LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP (1ULL << 3) +#endif + /// \brief Initialize Landlock ruleset attributes to forbid everything /// @@ -120,7 +129,10 @@ my_landlock_ruleset_attr_forbid_all(struct landlock_ruleset_attr *attr) // ABI 4 attr->handled_access_net = LANDLOCK_ACCESS_NET_BIND_TCP - | LANDLOCK_ACCESS_NET_CONNECT_TCP; + | LANDLOCK_ACCESS_NET_CONNECT_TCP + | LANDLOCK_ACCESS_NET_BIND_UDP // ABI 10 + | LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP // ABI 10 + ; #endif #ifdef LANDLOCK_SCOPE_SIGNAL @@ -168,9 +180,15 @@ my_landlock_ruleset_attr_forbid_all(struct landlock_ruleset_attr *attr) case 8: attr->handled_access_fs &= ~LANDLOCK_ACCESS_FS_RESOLVE_UNIX; FALLTHROUGH; + case 9: +#ifdef LANDLOCK_ACCESS_NET_BIND_TCP + attr->handled_access_net &= ~(LANDLOCK_ACCESS_NET_BIND_UDP + | LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP); +#endif + FALLTHROUGH; default: - // We only know about the features of the ABIs 1-6. + // We only know about the features of the ABIs 1-10. break; }