landlock 0.3 → 0.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0d4dc223f9ec0de53ff3ac2db1547a2bb21cee7fe670106795384c2d508395fd
-  data.tar.gz: 81db633dd067c82e68746b5bffb7db1b4a46a85984aededc03607a49f1ec5bd1
+  metadata.gz: b7494b5195627610f67bb7a41a5adcb99857f19e1639d88b1107d3d5d43a639c
+  data.tar.gz: '065496b9a75a046e91b1d9445dae704bd4531d7de61391d4506c9f480789a32a'
 SHA512:
-  metadata.gz: bcf9b3f9a3b369aca990a9ead22bdee7e5414baee0c73762504a10eb15fa87e56d75253f58802885621000b8e84f70d7ec5ee81b835ac1209b41476727079b81
-  data.tar.gz: 24f8ee88a25a18f5049b957878969cdb890a12f93e900bdda1402cbd1bf0ea33ec8841c96a3f6391bc216cea0730d361d4be24dac7ae19caf572f372c8c818c2
+  metadata.gz: 310b8cf56b7906297466b1273d4c5e924dc859148bc0adf143d44825b2c2b68be07d67d7058def44f9551470c48880b37963db2eb48be991b4a07829a03a3e9e
+  data.tar.gz: 362a3ea8d6aaf5115d100adf06524a53cfd87d9a46cfc29f1677c351196fadbffee88fa80d348b433d8d518ad3e517ec3893b6b5a827f9e67b799c5954b093b7

data/CHANGELOG.md

@@ -4,6 +4,13 @@ All notable changes to this project will be documented in this file.
 
 ## Unreleased
 
+## [0.4] - 2026-08-10
+
+### Changed
+
+- **Breaking.** `read:`, `write:`, `execute:`, `connect_tcp:` and `bind_tcp:` treat an empty array as "block all" rather than "allow all". These were previously controlled by the length of each allowlist, so `read: []` turned off all read restrictions instead of denying everything. `nil` is now the "restrictions disabled" flag and the new default; `[]` means "restriction on, empty allowlist". Callers relying on `[]` to mean unrestricted must pass `nil`; callers passing populated arrays are unaffected.
+- The native helper marks an enabled-but-empty restriction by passing the existing flag with an empty value, e.g. `--write ""`. An omitted flag leaves the restriction disabled.
+
 ## [0.3] - 2026-06-17
 
 ### Added

data/README.md

@@ -119,8 +119,10 @@ stdout, stderr, status = Landlock.capture(
 Capture options:
 
 - `read:`, `write:`, `execute:` — filesystem allowlists. Explicit paths must exist; missing paths raise `ArgumentError` instead of being silently ignored.
+
+  These distinguish `nil` from `[]`. Omitting one (or passing `nil`) leaves that access class outside the ruleset's handled mask, so Landlock does not restrict it **anywhere** — `write: nil` means the child can still create, delete and rename files across the filesystem. Passing `[]` enforces the class while granting no paths, which is what you want for "must not write at all". Prefer `[]` over `nil` unless you deliberately want the class unpoliced.
 - `paths:` — exact path rules with explicit Landlock rights, e.g. `{ path:, rights: %i[read_file] }`.
-- `connect_tcp:` and `bind_tcp:` — allowed TCP ports. TCP access is unrestricted unless a network rule is provided.
+- `connect_tcp:` and `bind_tcp:` — allowed TCP ports, with the same `nil` versus `[]` distinction. `[]` denies all TCP for that operation and requires ABI v4+; `nil` leaves TCP unrestricted.
 - `scope:` — Landlock ABI v6+ scopes such as `:signal` and `:abstract_unix_socket`.
 - `seccomp_deny_network:` — additionally deny common Linux network syscalls with seccomp. This is Linux-specific and intended as defense in depth.
 - `rlimits:` — resource limits. Supported keys are `:cpu_seconds`, `:memory_bytes`, `:file_size_bytes`, `:open_files`, and `:processes`. Values must be non-negative integers.

data/ext/landlock/bin/safe_exec_helper.c

@@ -97,6 +97,15 @@ static void path_rule_list_push(path_rule_list *list, char *path, uint64_t right
   list->len++;
 }
 
+/* An empty value marks the class handled while granting nothing; a real path
+   or port is never the empty string, so the two cannot collide. */
+static void push_unless_empty(string_list *list, char *value, int *handled) {
+  *handled = 1;
+  if (value[0] != '\0') {
+    string_list_push(list, value);
+  }
+}
+
 static unsigned long long parse_ull(const char *value, const char *name) {
   if (!value || value[0] == '\0' || value[0] == '-' || value[0] == '+' ||
       isspace((unsigned char)value[0])) {
@@ -121,6 +130,13 @@ static unsigned long long parse_port(const char *value) {
   return port;
 }
 
+static void push_port_unless_empty(ull_list *list, const char *value, int *handled) {
+  *handled = 1;
+  if (value[0] != '\0') {
+    ull_list_push(list, parse_port(value));
+  }
+}
+
 static int abi_version(void) {
   long abi = ll_create_ruleset(NULL, 0, LANDLOCK_CREATE_RULESET_VERSION);
   if (abi < 0 && (errno == ENOSYS || errno == EOPNOTSUPP)) {
@@ -239,10 +255,11 @@ static void add_net_rule(int fd, unsigned long long port, uint64_t rights) {
 static void apply_landlock(string_list *read_paths, string_list *write_paths,
                            string_list *execute_paths, path_rule_list *path_rules,
                            ull_list *connect_ports, ull_list *bind_ports, uint64_t scoped,
-                           int allow_all_known) {
-  int need_fs = read_paths->len || write_paths->len || execute_paths->len || path_rules->len ||
+                           int allow_all_known, int handled_read, int handled_write,
+                           int handled_execute, int handled_connect, int handled_bind) {
+  int need_fs = handled_read || handled_write || handled_execute || path_rules->len ||
                 allow_all_known;
-  int need_net = connect_ports->len || bind_ports->len;
+  int need_net = handled_connect || handled_bind;
   int need_scope = scoped != 0;
   if (!need_fs && !need_net && !need_scope) {
     return;
@@ -262,13 +279,13 @@ static void apply_landlock(string_list *read_paths, string_list *write_paths,
   uint64_t known_fs_rights = known_fs_rights_for_abi(abi);
   uint64_t fs_handled = allow_all_known ? known_fs_rights : 0;
   if (!allow_all_known) {
-    if (read_paths->len) {
+    if (handled_read) {
       fs_handled |= read_rights();
     }
-    if (execute_paths->len) {
+    if (handled_execute) {
       fs_handled |= execute_rights();
     }
-    if (write_paths->len) {
+    if (handled_write) {
       fs_handled |= write_rights(abi);
     }
     for (size_t i = 0; i < path_rules->len; i++) {
@@ -281,10 +298,10 @@ static void apply_landlock(string_list *read_paths, string_list *write_paths,
     }
   }
   uint64_t net_handled = 0;
-  if (bind_ports->len) {
+  if (handled_bind) {
     net_handled |= LANDLOCK_ACCESS_NET_BIND_TCP;
   }
-  if (connect_ports->len) {
+  if (handled_connect) {
     net_handled |= LANDLOCK_ACCESS_NET_CONNECT_TCP;
   }
 
@@ -533,6 +550,8 @@ int main(int argc, char **argv) {
   path_rule_list path_rules = {0};
   ull_list connect_ports = {0}, bind_ports = {0};
   int seccomp_deny_network = 0, allow_all_known = 0, close_others = 1;
+  int handled_read = 0, handled_write = 0, handled_execute = 0;
+  int handled_connect = 0, handled_bind = 0;
   uint64_t scoped = 0;
   char *chdir_path = NULL;
   char **command_argv = NULL;
@@ -544,19 +563,19 @@ int main(int argc, char **argv) {
       break;
     }
     if (strcmp(argv[i], "--read") == 0) {
-      string_list_push(&read_paths, require_arg(argc, argv, &i));
+      push_unless_empty(&read_paths, require_arg(argc, argv, &i), &handled_read);
     } else if (strcmp(argv[i], "--write") == 0) {
-      string_list_push(&write_paths, require_arg(argc, argv, &i));
+      push_unless_empty(&write_paths, require_arg(argc, argv, &i), &handled_write);
     } else if (strcmp(argv[i], "--execute") == 0) {
-      string_list_push(&execute_paths, require_arg(argc, argv, &i));
+      push_unless_empty(&execute_paths, require_arg(argc, argv, &i), &handled_execute);
     } else if (strcmp(argv[i], "--path") == 0) {
       char *path = require_arg(argc, argv, &i);
       char *rights = require_arg(argc, argv, &i);
       path_rule_list_push(&path_rules, path, parse_fs_rights(rights));
     } else if (strcmp(argv[i], "--connect-tcp") == 0) {
-      ull_list_push(&connect_ports, parse_port(require_arg(argc, argv, &i)));
+      push_port_unless_empty(&connect_ports, require_arg(argc, argv, &i), &handled_connect);
     } else if (strcmp(argv[i], "--bind-tcp") == 0) {
-      ull_list_push(&bind_ports, parse_port(require_arg(argc, argv, &i)));
+      push_port_unless_empty(&bind_ports, require_arg(argc, argv, &i), &handled_bind);
     } else if (strcmp(argv[i], "--scope") == 0) {
       scoped |= scope_name(require_arg(argc, argv, &i));
     } else if (strcmp(argv[i], "--chdir") == 0) {
@@ -588,7 +607,8 @@ int main(int argc, char **argv) {
   }
 
   apply_landlock(&read_paths, &write_paths, &execute_paths, &path_rules, &connect_ports,
-                 &bind_ports, scoped, allow_all_known);
+                 &bind_ports, scoped, allow_all_known, handled_read, handled_write,
+                 handled_execute, handled_connect, handled_bind);
   if (seccomp_deny_network) {
     apply_seccomp_deny_network();
   }

data/lib/landlock/execution.rb

@@ -14,13 +14,13 @@ module Landlock
 
     def exec(
       argv,
-      read: [],
-      write: [],
-      execute: [],
-      connect_tcp: [],
-      bind_tcp: [],
-      paths: [],
-      scope: [],
+      read: nil,
+      write: nil,
+      execute: nil,
+      connect_tcp: nil,
+      bind_tcp: nil,
+      paths: nil,
+      scope: nil,
       chdir: nil,
       env: nil,
       unsetenv_others: false,
@@ -49,13 +49,13 @@ module Landlock
 
     def spawn(
       argv,
-      read: [],
-      write: [],
-      execute: [],
-      connect_tcp: [],
-      bind_tcp: [],
-      paths: [],
-      scope: [],
+      read: nil,
+      write: nil,
+      execute: nil,
+      connect_tcp: nil,
+      bind_tcp: nil,
+      paths: nil,
+      scope: nil,
       chdir: nil,
       env: nil,
       unsetenv_others: false,
@@ -82,13 +82,13 @@ module Landlock
 
     def capture_with(
       argv,
-      read: [],
-      write: [],
-      execute: [],
-      connect_tcp: [],
-      bind_tcp: [],
-      paths: [],
-      scope: [],
+      read: nil,
+      write: nil,
+      execute: nil,
+      connect_tcp: nil,
+      bind_tcp: nil,
+      paths: nil,
+      scope: nil,
       chdir: nil,
       env: nil,
       unsetenv_others: false,
@@ -178,8 +178,8 @@ module Landlock
     end
 
     def prepare_policy(read:, write:, execute:, connect_tcp:, bind_tcp:, paths:, scope:, chdir:, allow_all_known:)
-      connect_tcp = Validation.normalize_ports(connect_tcp, :connect_tcp)
-      bind_tcp = Validation.normalize_ports(bind_tcp, :bind_tcp)
+      connect_tcp = connect_tcp.nil? ? nil : Validation.normalize_ports(connect_tcp, :connect_tcp)
+      bind_tcp = bind_tcp.nil? ? nil : Validation.normalize_ports(bind_tcp, :bind_tcp)
       read, write, execute, paths = validate_policy_paths!(read:, write:, execute:, paths:, chdir:)
       { read:, write:, execute:, connect_tcp:, bind_tcp:, paths:, scope:, allow_all_known: }
     end
@@ -221,9 +221,9 @@ module Landlock
     def validate_policy_paths!(read:, write:, execute:, paths:, chdir:)
       base = chdir ? File.expand_path(chdir) : Dir.pwd
       abi = Native.abi_version
-      read = Validation.validate_existing_paths(read, :read, chdir:)
-      write = Validation.validate_existing_paths(write, :write, chdir:)
-      execute = Validation.validate_existing_paths(execute, :execute, chdir:)
+      read = read.nil? ? nil : Validation.validate_existing_paths(read, :read, chdir:)
+      write = write.nil? ? nil : Validation.validate_existing_paths(write, :write, chdir:)
+      execute = execute.nil? ? nil : Validation.validate_existing_paths(execute, :execute, chdir:)
       paths =
         Array(paths).map do |rule|
           path, rights = Policy.normalize_path_rule(rule)

data/lib/landlock/policy.rb

@@ -8,13 +8,13 @@ module Landlock
     module_function
 
     def restrict!(
-      read: [],
-      write: [],
-      execute: [],
-      connect_tcp: [],
-      bind_tcp: [],
-      paths: [],
-      scope: [],
+      read: nil,
+      write: nil,
+      execute: nil,
+      connect_tcp: nil,
+      bind_tcp: nil,
+      paths: nil,
+      scope: nil,
       allow_all_known: false
     )
       abi = Native.abi_version
@@ -61,8 +61,8 @@ module Landlock
     end
 
     def requested?(read:, write:, execute:, connect_tcp:, bind_tcp:, paths:, scope:, allow_all_known:)
-      allow_all_known || Array(read).any? || Array(write).any? || Array(execute).any? || Array(connect_tcp).any? ||
-        Array(bind_tcp).any? || Array(paths).any? || Array(scope).any?
+      allow_all_known || !read.nil? || !write.nil? || !execute.nil? || !connect_tcp.nil? || !bind_tcp.nil? ||
+        !Array(paths).empty? || !Array(scope).empty?
     end
 
     def path_rights(path, rights)
@@ -126,11 +126,14 @@ module Landlock
       rights
     end
 
+    # Landlock leaves any right absent from handled_access_fs unrestricted
+    # kernel-wide, so nil (do not police this class) and [] (police it, grant
+    # nothing) must produce different masks.
     def handled_fs_for(read:, write:, execute:, paths:, abi:)
       bits = 0
-      bits |= mask(READ_RIGHTS, FS_RIGHTS, abi) unless Array(read).empty?
-      bits |= mask(EXEC_RIGHTS, FS_RIGHTS, abi) unless Array(execute).empty?
-      bits |= mask(WRITE_RIGHTS, FS_RIGHTS, abi) unless Array(write).empty?
+      bits |= mask(READ_RIGHTS, FS_RIGHTS, abi) unless read.nil?
+      bits |= mask(EXEC_RIGHTS, FS_RIGHTS, abi) unless execute.nil?
+      bits |= mask(WRITE_RIGHTS, FS_RIGHTS, abi) unless write.nil?
       Array(paths).each do |rule|
         path, rights = normalize_path_rule(rule)
         bits |= path_rule_access_mask(File.expand_path(path), rights, abi)
@@ -140,8 +143,8 @@ module Landlock
 
     def handled_net_for(connect_tcp:, bind_tcp:, abi:)
       bits = 0
-      bits |= ACCESS_NET_CONNECT_TCP unless Array(connect_tcp).empty?
-      bits |= ACCESS_NET_BIND_TCP unless Array(bind_tcp).empty?
+      bits |= ACCESS_NET_CONNECT_TCP unless connect_tcp.nil?
+      bits |= ACCESS_NET_BIND_TCP unless bind_tcp.nil?
       return 0 if bits.zero?
 
       raise UnsupportedError, "Landlock network rules require ABI v4+; running ABI v#{abi}" if abi < 4

data/lib/landlock/runner/native.rb

@@ -202,15 +202,15 @@ module Landlock
         close_others:
       )
         args = [helper_path]
-        Array(read).each { |path| args << "--read" << path.to_s }
-        Array(write).each { |path| args << "--write" << path.to_s }
-        Array(execute).each { |path| args << "--execute" << path.to_s }
+        emit_rules(args, "--read", read)
+        emit_rules(args, "--write", write)
+        emit_rules(args, "--execute", execute)
         Array(paths).each do |rule|
           path, rights = Policy.normalize_path_rule(rule)
           args << "--path" << path.to_s << Array(rights).map(&:to_s).join(",")
         end
-        Array(connect_tcp).each { |port| args << "--connect-tcp" << port.to_s }
-        Array(bind_tcp).each { |port| args << "--bind-tcp" << port.to_s }
+        emit_rules(args, "--connect-tcp", connect_tcp)
+        emit_rules(args, "--bind-tcp", bind_tcp)
         Array(scope).each { |name| args << "--scope" << name.to_s }
         Array(rlimits).each { |key, value| args << "--rlimit" << "#{key}=#{value}" }
         args << "--allow-all-known" if allow_all_known
@@ -220,6 +220,16 @@ module Landlock
         args.concat(argv.map(&:to_s))
         args
       end
+
+      # An empty value keeps the rights in the handled mask while granting
+      # nothing; the empty string is never a valid path or port, so it cannot
+      # collide with a real entry.
+      def emit_rules(args, flag, values)
+        return if values.nil?
+        return args.push(flag, "") if Array(values).empty?
+
+        Array(values).each { |value| args.push(flag, value.to_s) }
+      end
     end
   end
 end

data/lib/landlock/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Landlock
-  VERSION = "0.3"
+  VERSION = "0.4"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: landlock
 version: !ruby/object:Gem::Version
-  version: '0.3'
+  version: '0.4'
 platform: ruby
 authors:
 - Sam Saffron
@@ -147,7 +147,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.6
+rubygems_version: 3.6.9
 specification_version: 4
 summary: Ruby bindings for Linux Landlock sandboxing
 test_files: []