root/xz
1
0
Fork 0
mirror of https://git.tukaani.org/xz.git synced 2026-10-31 03:14:56 +00:00
Code Issues Releases Wiki Activity

Landlock: Support ABI version 10

Browse Source 
Like TCP sockets, we do not need UDP sockets.

Co-authored-by: Lasse Collin <lasse.collin@tukaani.org>
Closes: https://github.com/tukaani-project/xz/pull/257
This commit is contained in:
Collin Funk 2026-10-17 21:36:10 -07:00 committed by Lasse Collin
parent 212937db48
commit 9af2540083
No known key found for this signature in database
GPG Key ID: 38EE757D69184620
1 changed files with 20 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
src/common/my_landlock.h
View File

@ -46,6 +46,15 @@
# define LANDLOCK_ACCESS_FS_RESOLVE_UNIX (1ULL << 16) # define LANDLOCK_ACCESS_FS_RESOLVE_UNIX (1ULL << 16)
#endif #endif
// handled_access_net was added in ABI version 4. Provide fallbacks
// for handled_access_net flags that were added in ABI version 10.
#ifndef LANDLOCK_ACCESS_NET_BIND_UDP
# define LANDLOCK_ACCESS_NET_BIND_UDP (1ULL << 2)
#endif
#ifndef LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP
# define LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP (1ULL << 3)
#endif
/// \brief Initialize Landlock ruleset attributes to forbid everything /// \brief Initialize Landlock ruleset attributes to forbid everything
/// ///
@ -120,7 +129,10 @@ my_landlock_ruleset_attr_forbid_all(struct landlock_ruleset_attr *attr)
// ABI 4 // ABI 4
attr->handled_access_net attr->handled_access_net
= LANDLOCK_ACCESS_NET_BIND_TCP = LANDLOCK_ACCESS_NET_BIND_TCP
| LANDLOCK_ACCESS_NET_CONNECT_TCP; | LANDLOCK_ACCESS_NET_CONNECT_TCP
| LANDLOCK_ACCESS_NET_BIND_UDP // ABI 10
| LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP // ABI 10
;
#endif #endif
#ifdef LANDLOCK_SCOPE_SIGNAL #ifdef LANDLOCK_SCOPE_SIGNAL
@ -168,9 +180,15 @@ my_landlock_ruleset_attr_forbid_all(struct landlock_ruleset_attr *attr)
case 8: case 8:
attr->handled_access_fs &= ~LANDLOCK_ACCESS_FS_RESOLVE_UNIX; attr->handled_access_fs &= ~LANDLOCK_ACCESS_FS_RESOLVE_UNIX;
FALLTHROUGH; FALLTHROUGH;
case 9:
#ifdef LANDLOCK_ACCESS_NET_BIND_TCP
attr->handled_access_net &= ~(LANDLOCK_ACCESS_NET_BIND_UDP
| LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP);
#endif
FALLTHROUGH;
default: default:
// We only know about the features of the ABIs 1-6. // We only know about the features of the ABIs 1-10.
break; break;
} }