Gotweb

Blob

Date:: Sun Feb 6 20:15:21 2022 UTC
Message:: portable: add support for landlock landlock is a new set of linux APIs that is conceptually similar to unveil(2): the idea is to restrict what a process can do on a specified part of the filesystem. There are some differences in the behaviour: the major one being that the landlock ruleset is inherited across execve(2). This just restricts the libexec helpers by completely revoking ANY filesystem access; after all they are the biggest attack surface. got send/fetch/clone *may* end up spawning ssh(1), so at the moment is not possible to landlock the main process. From Omar Polo.
Actions:: History | Blame | Raw File
1 #ifndef _GOT_COMPAT_H
2 #define _GOT_COMPAT_H
3 
4 #include <sys/types.h>
5 #include <sys/ioctl.h>
6 #include <sys/uio.h>
7 #if defined(__FreeBSD__)
8 #include <sys/endian.h>
9 #else
10 #include <endian.h>
11 #endif
12 
13 #include <fnmatch.h>
14 #include <limits.h>
15 #include <stdio.h>
16 #include <stdint.h>
17 
18 /*
19 #include <termios.h>
20 #include <wchar.h>
21 */
22 
23 /* For flock. */
24 #ifndef O_EXLOCK
25 #define O_EXLOCK 0
26 #endif
27 
28 #ifndef HAVE_FLOCK
29 #define LOCK_SH 0
30 #define LOCK_EX 0
31 #define LOCK_NB 0
32 #define flock(fd, op) (0)
33 #else
34 #include <sys/file.h>
35 #endif
36 
37 #ifndef __dead
38 #define __dead __attribute__ ((__noreturn__))
39 #endif
40 
41 #ifndef __OpenBSD__
42 #define pledge(s, p) (0)
43 #define unveil(s, p) (0)
44 #endif
45 
46 #ifndef HAVE_LINUX_LANDLOCK_H
47 #define landlock_no_fs() (0)
48 #else
49 int	landlock_no_fs(void);
50 #endif
51 
52 #ifndef INFTIM
53 #define INFTIM -1
54 #endif
55 
56 #ifndef HAVE_BSD_UUID
57 #include <uuid/uuid.h>
58 #define uuid_s_ok 0
59 #define uuid_s_bad_version  1
60 #define uuid_s_invalid_string_uuid 2
61 #define uuid_s_no_memory  3
62 
63 /* Length of a node address (an IEEE 802 address). */
64 #define _UUID_NODE_LEN  6
65 
66 struct uuid {
67 	uint32_t time_low;
68 	uint16_t time_mid;
69 	uint16_t time_hi_and_version;
70 	uint8_t  clock_seq_hi_and_reserved;
71 	uint8_t  clock_seq_low;
72 	uint8_t  node[_UUID_NODE_LEN];
73 };
74 
75 int32_t uuid_equal(struct uuid *, struct uuid *, uint32_t *);
76 int32_t uuid_is_nil(struct uuid *, uint32_t *);
77 void uuid_create(uuid_t *, uint32_t *);
78 void uuid_create_nil(struct uuid *, uint32_t *);
79 void uuid_from_string(const char *, uuid_t *, uint32_t *);
80 void uuid_to_string(uuid_t *, char **, uint32_t *);
81 #endif
82 
83 #ifdef HAVE_STDINT_H
84 #include <stdint.h>
85 #else
86 #include <inttypes.h>
87 #endif
88 
89 #ifdef HAVE_QUEUE_H
90 #include <sys/queue.h>
91 #else
92 #include "compat/queue.h"
93 #endif
94 
95 #ifdef HAVE_TREE_H
96 #include <sys/tree.h>
97 #else
98 #include "compat/tree.h"
99 #endif
100 
101 #ifdef HAVE_UTIL_H
102 #include <util.h>
103 #endif
104 
105 #ifdef HAVE_LIBUTIL_H
106 #include <libutil.h>
107 #endif
108 
109 #ifdef HAVE_IMSG
110 #else
111 #include "compat/imsg.h"
112 #endif
113 
114 #ifdef HAVE_LIBCRYPTO
115 #include <sha1.h>
116 #else
117 #include <sha.h>
118 
119 #define SHA1_DIGEST_LENGTH		SHA_DIGEST_LENGTH
120 #define SHA1_DIGEST_STRING_LENGTH	(SHA1_DIGEST_LENGTH * 2 + 1)
121 
122 #define SHA1_CTX	SHA_CTX
123 #define SHA1Init	SHA1_Init
124 #define SHA1Update	SHA1_Update
125 #define SHA1Final	SHA1_Final
126 #endif
127 
128 #ifndef HAVE_ASPRINTF
129 /* asprintf.c */
130 int		 asprintf(char **, const char *, ...);
131 int		 vasprintf(char **, const char *, va_list);
132 #endif
133 
134 #ifndef HAVE_EXPLICIT_BZERO
135 /* explicit_bzero.c */
136 void		 explicit_bzero(void *, size_t);
137 #endif
138 
139 #ifndef HAVE_GETDTABLECOUNT
140 /* getdtablecount.c */
141 int		 getdtablecount(void);
142 #endif
143 
144 #ifndef HAVE_CLOSEFROM
145 /* closefrom.c */
146 //void		 closefrom(int);
147 #define closefrom(fd) (closefrom(fd), 0)
148 #endif
149 
150 #if defined (__FreeBSD__)
151 #define closefrom(fd) (closefrom(fd), 0)
152 #endif
153 
154 #ifndef HAVE_STRSEP
155 /* strsep.c */
156 char		*strsep(char **, const char *);
157 #endif
158 
159 #ifndef HAVE_STRTONUM
160 /* strtonum.c */
161 long long	 strtonum(const char *, long long, long long, const char **);
162 #endif
163 
164 #ifndef HAVE_STRLCPY
165 /* strlcpy.c */
166 size_t	 	 strlcpy(char *, const char *, size_t);
167 #endif
168 
169 #ifndef HAVE_STRLCAT
170 /* strlcat.c */
171 size_t	 	 strlcat(char *, const char *, size_t);
172 #endif
173 
174 #ifndef HAVE_STRNLEN
175 /* strnlen.c */
176 size_t		 strnlen(const char *, size_t);
177 #endif
178 
179 #ifndef HAVE_STRNDUP
180 /* strndup.c */
181 char		*strndup(const char *, size_t);
182 #endif
183 
184 #ifndef HAVE_GETPROGNAME
185 /* getprogname.c */
186 const char	*getprogname(void);
187 #endif
188 
189 #ifndef HAVE_GETLINE
190 /* getline.c */
191 ssize_t		 getline(char **, size_t *, FILE *);
192 #endif
193 
194 #ifndef HAVE_FREEZERO
195 /* freezero.c */
196 void		 freezero(void *, size_t);
197 #endif
198 
199 #ifndef HAVE_GETDTABLECOUNT
200 /* getdtablecount.c */
201 int		 getdtablecount(void);
202 #endif
203 
204 #ifndef HAVE_REALLOCARRAY
205 /* reallocarray.c */
206 void		*reallocarray(void *, size_t, size_t);
207 #endif
208 
209 #ifndef HAVE_RECALLOCARRAY
210 /* recallocarray.c */
211 void		*recallocarray(void *, size_t, size_t, size_t);
212 #endif
213 
214 #ifndef HAVE_FMT_SCALED
215 /* fmt_scaled.c */
216 int fmt_scaled(long long, char *);
217 int scan_scaled(char *, long long *);
218 #define FMT_SCALED_STRSIZE	7  /* minus sign, 4 digits, suffix, null byte */
219 
220 #endif
221 
222 #ifndef HAVE_LIBBSD
223 /* getopt.c */
224 extern int	BSDopterr;
225 extern int	BSDoptind;
226 extern int	BSDoptopt;
227 extern int	BSDoptreset;
228 extern char    *BSDoptarg;
229 int	BSDgetopt(int, char *const *, const char *);
230 #define getopt(ac, av, o)  BSDgetopt(ac, av, o)
231 #define opterr             BSDopterr
232 #define optind             BSDoptind
233 #define optopt             BSDoptopt
234 #define optreset           BSDoptreset
235 #define optarg             BSDoptarg
236 #endif
237 #endif
238 
239 /* Check for some of the non-portable timespec*() functions.
240  * This should largely come from libbsd for systems which
241  * aren't BSD, but this will depend on how old the library
242  * is.
243  */
244 #ifndef timespecisset
245 #define	timespecisset(tsp) \
246 	((tsp)->tv_sec || (tsp)->tv_nsec)
247 #endif
248 
249 #ifndef timespecsub
250 #define	timespecsub(tsp, usp, vsp)					\
251 	do {								\
252 		(vsp)->tv_sec = (tsp)->tv_sec - (usp)->tv_sec;		\
253 		(vsp)->tv_nsec = (tsp)->tv_nsec - (usp)->tv_nsec;	\
254 		if ((vsp)->tv_nsec < 0) {				\
255 			(vsp)->tv_sec--;				\
256 			(vsp)->tv_nsec += 1000000000L;			\
257 		}							\
258 	} while (0)
259 #endif
260 
261 #ifndef timespeccmp
262 #define timespeccmp(tvp, uvp, cmp) 					\
263 (((tvp)->tv_sec == (uvp)->tv_sec) ? 					\
264 	((tvp)->tv_nsec cmp (uvp)->tv_nsec) : 				\
265 	((tvp)->tv_sec cmp (uvp)->tv_sec))
266 #endif
267 
268 #ifndef HAVE_BSD_MERGESORT
269 /* mergesort.c */
270 int mergesort(void *, size_t, size_t, int (*)(const void *, const void *));
271 #endif