landlock 0.1.1 → 0.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (11) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +8 -0
  3. data/README.md +72 -0
  4. data/ext/landlock/bin/safe_exec_helper.c +369 -0
  5. data/ext/landlock/extconf.rb +30 -0
  6. data/ext/landlock/landlock.c +6 -164
  7. data/ext/landlock/landlock_native.h +167 -0
  8. data/lib/landlock/safe_exec.rb +522 -0
  9. data/lib/landlock/version.rb +1 -1
  10. data/lib/landlock.rb +1 -0
  11. metadata +4 -1
data/ext/landlock/landlock.c CHANGED
@@ -1,175 +1,12 @@
1
1
  #include "ruby.h"
2
+ #include "landlock_native.h"
2
3
 
3
- #include <errno.h>
4
- #include <fcntl.h>
5
- #include <stdint.h>
6
- #include <stddef.h>
7
4
  #include <string.h>
8
- #include <unistd.h>
9
- #include <sys/prctl.h>
10
- #include <sys/syscall.h>
11
-
12
- #ifdef HAVE_LINUX_LANDLOCK_H
13
- #include <linux/landlock.h>
14
- #endif
15
-
16
- #ifndef SYS_landlock_create_ruleset
17
- # if defined(__NR_landlock_create_ruleset) && defined(__NR_landlock_add_rule) && defined(__NR_landlock_restrict_self)
18
- # define SYS_landlock_create_ruleset __NR_landlock_create_ruleset
19
- # define SYS_landlock_add_rule __NR_landlock_add_rule
20
- # define SYS_landlock_restrict_self __NR_landlock_restrict_self
21
- # elif defined(__x86_64__) && defined(__ILP32__)
22
- # ifndef __X32_SYSCALL_BIT
23
- # define __X32_SYSCALL_BIT 0x40000000
24
- # endif
25
- # define SYS_landlock_create_ruleset (__X32_SYSCALL_BIT + 444)
26
- # define SYS_landlock_add_rule (__X32_SYSCALL_BIT + 445)
27
- # define SYS_landlock_restrict_self (__X32_SYSCALL_BIT + 446)
28
- # elif defined(__x86_64__)
29
- # define SYS_landlock_create_ruleset 444
30
- # define SYS_landlock_add_rule 445
31
- # define SYS_landlock_restrict_self 446
32
- # elif defined(__aarch64__)
33
- # define SYS_landlock_create_ruleset 444
34
- # define SYS_landlock_add_rule 445
35
- # define SYS_landlock_restrict_self 446
36
- # elif defined(__i386__)
37
- # define SYS_landlock_create_ruleset 444
38
- # define SYS_landlock_add_rule 445
39
- # define SYS_landlock_restrict_self 446
40
- # endif
41
- #endif
42
-
43
- #ifndef LANDLOCK_CREATE_RULESET_VERSION
44
- #define LANDLOCK_CREATE_RULESET_VERSION (1U << 0)
45
- #endif
46
-
47
- #ifndef LANDLOCK_RULE_PATH_BENEATH
48
- #define LANDLOCK_RULE_PATH_BENEATH 1
49
- #endif
50
-
51
- #ifndef LANDLOCK_RULE_NET_PORT
52
- #define LANDLOCK_RULE_NET_PORT 2
53
- #endif
54
-
55
- #ifndef LANDLOCK_ACCESS_FS_EXECUTE
56
- #define LANDLOCK_ACCESS_FS_EXECUTE (1ULL << 0)
57
- #endif
58
- #ifndef LANDLOCK_ACCESS_FS_WRITE_FILE
59
- #define LANDLOCK_ACCESS_FS_WRITE_FILE (1ULL << 1)
60
- #endif
61
- #ifndef LANDLOCK_ACCESS_FS_READ_FILE
62
- #define LANDLOCK_ACCESS_FS_READ_FILE (1ULL << 2)
63
- #endif
64
- #ifndef LANDLOCK_ACCESS_FS_READ_DIR
65
- #define LANDLOCK_ACCESS_FS_READ_DIR (1ULL << 3)
66
- #endif
67
- #ifndef LANDLOCK_ACCESS_FS_REMOVE_DIR
68
- #define LANDLOCK_ACCESS_FS_REMOVE_DIR (1ULL << 4)
69
- #endif
70
- #ifndef LANDLOCK_ACCESS_FS_REMOVE_FILE
71
- #define LANDLOCK_ACCESS_FS_REMOVE_FILE (1ULL << 5)
72
- #endif
73
- #ifndef LANDLOCK_ACCESS_FS_MAKE_CHAR
74
- #define LANDLOCK_ACCESS_FS_MAKE_CHAR (1ULL << 6)
75
- #endif
76
- #ifndef LANDLOCK_ACCESS_FS_MAKE_DIR
77
- #define LANDLOCK_ACCESS_FS_MAKE_DIR (1ULL << 7)
78
- #endif
79
- #ifndef LANDLOCK_ACCESS_FS_MAKE_REG
80
- #define LANDLOCK_ACCESS_FS_MAKE_REG (1ULL << 8)
81
- #endif
82
- #ifndef LANDLOCK_ACCESS_FS_MAKE_SOCK
83
- #define LANDLOCK_ACCESS_FS_MAKE_SOCK (1ULL << 9)
84
- #endif
85
- #ifndef LANDLOCK_ACCESS_FS_MAKE_FIFO
86
- #define LANDLOCK_ACCESS_FS_MAKE_FIFO (1ULL << 10)
87
- #endif
88
- #ifndef LANDLOCK_ACCESS_FS_MAKE_BLOCK
89
- #define LANDLOCK_ACCESS_FS_MAKE_BLOCK (1ULL << 11)
90
- #endif
91
- #ifndef LANDLOCK_ACCESS_FS_MAKE_SYM
92
- #define LANDLOCK_ACCESS_FS_MAKE_SYM (1ULL << 12)
93
- #endif
94
- #ifndef LANDLOCK_ACCESS_FS_REFER
95
- #define LANDLOCK_ACCESS_FS_REFER (1ULL << 13)
96
- #endif
97
- #ifndef LANDLOCK_ACCESS_FS_TRUNCATE
98
- #define LANDLOCK_ACCESS_FS_TRUNCATE (1ULL << 14)
99
- #endif
100
- #ifndef LANDLOCK_ACCESS_FS_IOCTL_DEV
101
- #define LANDLOCK_ACCESS_FS_IOCTL_DEV (1ULL << 15)
102
- #endif
103
-
104
- #ifndef LANDLOCK_ACCESS_NET_BIND_TCP
105
- #define LANDLOCK_ACCESS_NET_BIND_TCP (1ULL << 0)
106
- #endif
107
- #ifndef LANDLOCK_ACCESS_NET_CONNECT_TCP
108
- #define LANDLOCK_ACCESS_NET_CONNECT_TCP (1ULL << 1)
109
- #endif
110
-
111
- #ifndef LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET
112
- #define LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET (1ULL << 0)
113
- #endif
114
- #ifndef LANDLOCK_SCOPE_SIGNAL
115
- #define LANDLOCK_SCOPE_SIGNAL (1ULL << 1)
116
- #endif
117
-
118
- #ifndef O_PATH
119
- #define O_PATH 010000000
120
- #endif
121
-
122
- #ifndef O_CLOEXEC
123
- #define O_CLOEXEC 02000000
124
- #endif
125
-
126
- struct rb_landlock_ruleset_attr {
127
- uint64_t handled_access_fs;
128
- uint64_t handled_access_net;
129
- uint64_t scoped;
130
- };
131
-
132
- struct rb_landlock_path_beneath_attr {
133
- uint64_t allowed_access;
134
- int32_t parent_fd;
135
- } __attribute__((packed));
136
-
137
- struct rb_landlock_net_port_attr {
138
- uint64_t allowed_access;
139
- uint64_t port;
140
- };
141
5
 
142
6
  static VALUE mLandlock;
143
7
  static VALUE eLandlockError;
144
8
  static VALUE eSyscallError;
145
9
 
146
- static long ll_create_ruleset(const void *attr, size_t size, uint32_t flags) {
147
- #ifdef SYS_landlock_create_ruleset
148
- return syscall(SYS_landlock_create_ruleset, attr, size, flags);
149
- #else
150
- errno = ENOSYS;
151
- return -1;
152
- #endif
153
- }
154
-
155
- static long ll_add_rule(int ruleset_fd, int rule_type, const void *rule_attr, uint32_t flags) {
156
- #ifdef SYS_landlock_add_rule
157
- return syscall(SYS_landlock_add_rule, ruleset_fd, rule_type, rule_attr, flags);
158
- #else
159
- errno = ENOSYS;
160
- return -1;
161
- #endif
162
- }
163
-
164
- static long ll_restrict_self(int ruleset_fd, uint32_t flags) {
165
- #ifdef SYS_landlock_restrict_self
166
- return syscall(SYS_landlock_restrict_self, ruleset_fd, flags);
167
- #else
168
- errno = ENOSYS;
169
- return -1;
170
- #endif
171
- }
172
-
173
10
  static void raise_syscall_error(const char *syscall_name) {
174
11
  int saved_errno = errno;
175
12
  VALUE err = rb_funcall(eSyscallError, rb_intern("new"), 3,
@@ -250,6 +87,7 @@ static VALUE rb_ll_add_net_rule(VALUE self, VALUE ruleset_fd, VALUE port, VALUE
250
87
  }
251
88
 
252
89
  static VALUE rb_ll_restrict_self(VALUE self, VALUE ruleset_fd) {
90
+ #ifdef __linux__
253
91
  if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) != 0) {
254
92
  raise_syscall_error("prctl(PR_SET_NO_NEW_PRIVS)");
255
93
  }
@@ -257,6 +95,10 @@ static VALUE rb_ll_restrict_self(VALUE self, VALUE ruleset_fd) {
257
95
  long ret = ll_restrict_self(NUM2INT(ruleset_fd), 0);
258
96
  if (ret < 0) raise_syscall_error("landlock_restrict_self");
259
97
  return Qtrue;
98
+ #else
99
+ errno = ENOSYS;
100
+ raise_syscall_error("landlock_restrict_self");
101
+ #endif
260
102
  }
261
103
 
262
104
  static VALUE rb_ll_close_fd(VALUE self, VALUE fd_value) {
data/ext/landlock/landlock_native.h ADDED
@@ -0,0 +1,167 @@
1
+ #ifndef RB_LANDLOCK_NATIVE_H
2
+ #define RB_LANDLOCK_NATIVE_H
3
+
4
+ #include <errno.h>
5
+ #include <fcntl.h>
6
+ #include <stddef.h>
7
+ #include <stdint.h>
8
+ #include <unistd.h>
9
+
10
+ #ifdef __linux__
11
+ #include <sys/prctl.h>
12
+ #include <sys/syscall.h>
13
+ #ifdef HAVE_LINUX_LANDLOCK_H
14
+ #include <linux/landlock.h>
15
+ #endif
16
+ #endif
17
+
18
+ #ifndef SYS_landlock_create_ruleset
19
+ # if defined(__linux__) && defined(__NR_landlock_create_ruleset) && defined(__NR_landlock_add_rule) && defined(__NR_landlock_restrict_self)
20
+ # define SYS_landlock_create_ruleset __NR_landlock_create_ruleset
21
+ # define SYS_landlock_add_rule __NR_landlock_add_rule
22
+ # define SYS_landlock_restrict_self __NR_landlock_restrict_self
23
+ # elif defined(__linux__) && defined(__x86_64__) && defined(__ILP32__)
24
+ # ifndef __X32_SYSCALL_BIT
25
+ # define __X32_SYSCALL_BIT 0x40000000
26
+ # endif
27
+ # define SYS_landlock_create_ruleset (__X32_SYSCALL_BIT + 444)
28
+ # define SYS_landlock_add_rule (__X32_SYSCALL_BIT + 445)
29
+ # define SYS_landlock_restrict_self (__X32_SYSCALL_BIT + 446)
30
+ # elif defined(__linux__) && (defined(__x86_64__) || defined(__aarch64__) || defined(__i386__))
31
+ # define SYS_landlock_create_ruleset 444
32
+ # define SYS_landlock_add_rule 445
33
+ # define SYS_landlock_restrict_self 446
34
+ # endif
35
+ #endif
36
+
37
+ #ifndef LANDLOCK_CREATE_RULESET_VERSION
38
+ #define LANDLOCK_CREATE_RULESET_VERSION (1U << 0)
39
+ #endif
40
+
41
+ #ifndef LANDLOCK_RULE_PATH_BENEATH
42
+ #define LANDLOCK_RULE_PATH_BENEATH 1
43
+ #endif
44
+
45
+ #ifndef LANDLOCK_RULE_NET_PORT
46
+ #define LANDLOCK_RULE_NET_PORT 2
47
+ #endif
48
+
49
+ #ifndef LANDLOCK_ACCESS_FS_EXECUTE
50
+ #define LANDLOCK_ACCESS_FS_EXECUTE (1ULL << 0)
51
+ #endif
52
+ #ifndef LANDLOCK_ACCESS_FS_WRITE_FILE
53
+ #define LANDLOCK_ACCESS_FS_WRITE_FILE (1ULL << 1)
54
+ #endif
55
+ #ifndef LANDLOCK_ACCESS_FS_READ_FILE
56
+ #define LANDLOCK_ACCESS_FS_READ_FILE (1ULL << 2)
57
+ #endif
58
+ #ifndef LANDLOCK_ACCESS_FS_READ_DIR
59
+ #define LANDLOCK_ACCESS_FS_READ_DIR (1ULL << 3)
60
+ #endif
61
+ #ifndef LANDLOCK_ACCESS_FS_REMOVE_DIR
62
+ #define LANDLOCK_ACCESS_FS_REMOVE_DIR (1ULL << 4)
63
+ #endif
64
+ #ifndef LANDLOCK_ACCESS_FS_REMOVE_FILE
65
+ #define LANDLOCK_ACCESS_FS_REMOVE_FILE (1ULL << 5)
66
+ #endif
67
+ #ifndef LANDLOCK_ACCESS_FS_MAKE_CHAR
68
+ #define LANDLOCK_ACCESS_FS_MAKE_CHAR (1ULL << 6)
69
+ #endif
70
+ #ifndef LANDLOCK_ACCESS_FS_MAKE_DIR
71
+ #define LANDLOCK_ACCESS_FS_MAKE_DIR (1ULL << 7)
72
+ #endif
73
+ #ifndef LANDLOCK_ACCESS_FS_MAKE_REG
74
+ #define LANDLOCK_ACCESS_FS_MAKE_REG (1ULL << 8)
75
+ #endif
76
+ #ifndef LANDLOCK_ACCESS_FS_MAKE_SOCK
77
+ #define LANDLOCK_ACCESS_FS_MAKE_SOCK (1ULL << 9)
78
+ #endif
79
+ #ifndef LANDLOCK_ACCESS_FS_MAKE_FIFO
80
+ #define LANDLOCK_ACCESS_FS_MAKE_FIFO (1ULL << 10)
81
+ #endif
82
+ #ifndef LANDLOCK_ACCESS_FS_MAKE_BLOCK
83
+ #define LANDLOCK_ACCESS_FS_MAKE_BLOCK (1ULL << 11)
84
+ #endif
85
+ #ifndef LANDLOCK_ACCESS_FS_MAKE_SYM
86
+ #define LANDLOCK_ACCESS_FS_MAKE_SYM (1ULL << 12)
87
+ #endif
88
+ #ifndef LANDLOCK_ACCESS_FS_REFER
89
+ #define LANDLOCK_ACCESS_FS_REFER (1ULL << 13)
90
+ #endif
91
+ #ifndef LANDLOCK_ACCESS_FS_TRUNCATE
92
+ #define LANDLOCK_ACCESS_FS_TRUNCATE (1ULL << 14)
93
+ #endif
94
+ #ifndef LANDLOCK_ACCESS_FS_IOCTL_DEV
95
+ #define LANDLOCK_ACCESS_FS_IOCTL_DEV (1ULL << 15)
96
+ #endif
97
+
98
+ #ifndef LANDLOCK_ACCESS_NET_BIND_TCP
99
+ #define LANDLOCK_ACCESS_NET_BIND_TCP (1ULL << 0)
100
+ #endif
101
+ #ifndef LANDLOCK_ACCESS_NET_CONNECT_TCP
102
+ #define LANDLOCK_ACCESS_NET_CONNECT_TCP (1ULL << 1)
103
+ #endif
104
+
105
+ #ifndef LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET
106
+ #define LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET (1ULL << 0)
107
+ #endif
108
+ #ifndef LANDLOCK_SCOPE_SIGNAL
109
+ #define LANDLOCK_SCOPE_SIGNAL (1ULL << 1)
110
+ #endif
111
+
112
+ #ifndef O_PATH
113
+ #define O_PATH 010000000
114
+ #endif
115
+
116
+ #ifndef O_CLOEXEC
117
+ #define O_CLOEXEC 02000000
118
+ #endif
119
+
120
+ #ifndef PR_SET_NO_NEW_PRIVS
121
+ #define PR_SET_NO_NEW_PRIVS 38
122
+ #endif
123
+
124
+ struct rb_landlock_ruleset_attr {
125
+ uint64_t handled_access_fs;
126
+ uint64_t handled_access_net;
127
+ uint64_t scoped;
128
+ };
129
+
130
+ struct rb_landlock_path_beneath_attr {
131
+ uint64_t allowed_access;
132
+ int32_t parent_fd;
133
+ } __attribute__((packed));
134
+
135
+ struct rb_landlock_net_port_attr {
136
+ uint64_t allowed_access;
137
+ uint64_t port;
138
+ };
139
+
140
+ static long ll_create_ruleset(const void *attr, size_t size, uint32_t flags) {
141
+ #ifdef SYS_landlock_create_ruleset
142
+ return syscall(SYS_landlock_create_ruleset, attr, size, flags);
143
+ #else
144
+ errno = ENOSYS;
145
+ return -1;
146
+ #endif
147
+ }
148
+
149
+ static long ll_add_rule(int ruleset_fd, int rule_type, const void *rule_attr, uint32_t flags) {
150
+ #ifdef SYS_landlock_add_rule
151
+ return syscall(SYS_landlock_add_rule, ruleset_fd, rule_type, rule_attr, flags);
152
+ #else
153
+ errno = ENOSYS;
154
+ return -1;
155
+ #endif
156
+ }
157
+
158
+ static long ll_restrict_self(int ruleset_fd, uint32_t flags) {
159
+ #ifdef SYS_landlock_restrict_self
160
+ return syscall(SYS_landlock_restrict_self, ruleset_fd, flags);
161
+ #else
162
+ errno = ENOSYS;
163
+ return -1;
164
+ #endif
165
+ }
166
+
167
+ #endif