landlock: apply rules in sandbox before app start

Apply rules in the sandbox thread before the application is started.
kmk3 · Nov 7, 2023 · b94cc75 · b94cc75
1 parent abc1edc
commit b94cc75
Show file tree

Hide file tree

Showing 4 changed files with 28 additions and 8 deletions.
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
@@ -150,6 +150,11 @@ typedef struct profile_entry_t {
 
 } ProfileEntry;
 
+typedef struct landlock_entry_t {
+ struct landlock_entry_t *next;
+ char *data;
+} LandlockEntry;
+
 typedef struct config_t {
  // user data
  char *username;
@@ -159,6 +164,7 @@ typedef struct config_t {
  // filesystem
  ProfileEntry *profile;
  ProfileEntry *profile_rebuild_etc; // blacklist files in /etc directory used by fs_rebuild_etc()
+ LandlockEntry *lprofile;
 
 #define MAX_PROFILE_IGNORE 32
  char *profile_ignore[MAX_PROFILE_IGNORE];
@@ -962,6 +968,7 @@ int ll_special(const char *allowed_path);
 int ll_exec(const char *allowed_path);
 int ll_basic_system(void);
 int ll_restrict(__u32 flags);
+void ll_add_profile(const char *data);
 #else
 static inline int ll_get_fd(void) { return -1; }
 static inline int ll_read(...) { return 0; }
@@ -970,6 +977,7 @@ static inline int ll_special(...) { return 0; }
 static inline int ll_exec(...) { return 0; }
 static inline int ll_basic_system(void) { return 0; }
 static inline int ll_restrict(...) { return 0; }
+static inline void ll_add_profile(...) { return; }
 #endif /* HAVE_LANDLOCK */
 
 #endif
diff --git a/src/firejail/landlock.c b/src/firejail/landlock.c
@@ -278,4 +278,16 @@ int ll_restrict(__u32 flags) {
  return error;
 }
 
+void ll_add_profile(const char *data) {
+ LandlockEntry *ptr = malloc(sizeof(LandlockEntry));
+ if (!ptr)
+ errExit("malloc");
+ memset(ptr, 0, sizeof(LandlockEntry));
+ ptr->data = strdup(data);
+ if (!ptr->data)
+ errExit("strdup");
+ ptr->next = cfg.lprofile;
+ cfg.lprofile = ptr;
+}
+
 #endif /* HAVE_LANDLOCK */
diff --git a/src/firejail/main.c b/src/firejail/main.c
@@ -1520,13 +1520,13 @@ int main(int argc, char **argv, char **envp) {
  }
  }
  else if (strncmp(argv[i], "--landlock.read=", 16) == 0)
- ll_read(argv[i] + 16);
+ ll_add_profile(argv[i] + 2);
  else if (strncmp(argv[i], "--landlock.write=", 17) == 0)
- ll_write(argv[i] + 17);
+ ll_add_profile(argv[i] + 2);
  else if (strncmp(argv[i], "--landlock.special=", 19) == 0)
- ll_special(argv[i] + 19);
+ ll_add_profile(argv[i] + 2);
  else if (strncmp(argv[i], "--landlock.execute=", 19) == 0)
- ll_exec(argv[i] + 19);
+ ll_add_profile(argv[i] + 2);
 #endif
  else if (strcmp(argv[i], "--memory-deny-write-execute") == 0) {
  if (checkcfg(CFG_SECCOMP))

diff --git a/src/firejail/profile.c b/src/firejail/profile.c
@@ -1098,19 +1098,19 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
  return 0;
  }
  if (strncmp(ptr, "landlock.read ", 14) == 0) {
- ll_read(ptr + 14);
+ ll_add_profile(ptr);
  return 0;
  }
  if (strncmp(ptr, "landlock.write ", 15) == 0) {
- ll_write(ptr + 15);
+ ll_add_profile(ptr);
  return 0;
  }
  if (strncmp(ptr, "landlock.special ", 17) == 0) {
- ll_special(ptr + 17);
+ ll_add_profile(ptr);
  return 0;
  }
  if (strncmp(ptr, "landlock.execute ", 17) == 0) {
- ll_exec(ptr + 17);
+ ll_add_profile(ptr);
  return 0;
  }
 #endif