Question about using Landlock

--Sig_/othNkk7hQ9GIp7C7o8luXcX
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Hello,

I would like to use Landlock in my program to improve security under
Linux. I have a few questions about this:

1. The documentation uses the Landlock functions without syscall. [1]
For example, `landlock_create_ruleset` instead of `int
syscall(SYS_landlock_create_ruleset, ...)`. In which header file are
these landlock_* functions declared? My compiler says it cannot find
them. As a workaround, I currently check whether these functions exist
when configuring the project [2], and if not, I create them [3].
However, this workaround also has problems: syscall returns a long and
the Landlock functions return int, which means I have to perform a
conversion, but there is a possible loss of information from long to
int.

2. I don't quite understand how to add rules to Lockland's rule set.
When accessing the file system, I'm supposed to specify the fd of the
file, but then I already have that file open. And that's exactly what
Lockland is supposed to control. Another problem is that I work with
several libraries: for example, `yaml-cpp` to read my configuration
file, `libtuntap` to create a TAP device, and boost.asio to read and
write from this TAP device. These libraries create files without me
controlling this with my own syscall. How could I integrate Lockland
there?

For example, I create the TAP device (before Lockland controls it) and
then try to restrict access with Lockland. [4] However, I am unsure
whether I am using Lockland correctly.
```
tun_tap dev(config.get_device_name(), tun_tap_mode::tap);
[...]
landlock_ruleset_loop.add_path_beneath_rule(LANDLOCK_ACCESS_FS_WRITE_FILE
| LANDLOCK_ACCESS_FS_READ_FILE | LANDLOCK_ACCESS_FS_IOCTL_DEV,
dev.native_handler());
landlock_ruleset_loop.restrict_self();
[...]
const Crazytrace ct(io.get_executor(), ::dup(dev.native_handler()),
nodecontainer);
io.run();
```

3. Lockland introduces scoped access control starting with ABI 6. To
avoid getting warnings from the compiler (and linter), I need to know
whether the struct landlock_ruleset_attr has scoped access control or
not when programming. Since I only want to support the case where this
is true, I would like to check the ABI version at compile time and
generate a more meaningful error. How can I check the ABI version at
compile time? Is there a macro for this?
Currently, I am using a check to see if the compiler can compile the
struct with `scoped`. [5] However, I don't think this is very elegant.

I hope it's okay for me, as a landlocked newbie, to ask questions like
this here. In any case, I would really appreciate any answers!

Best regards,
Marek K=C3=BCthe

[1] https://docs.kernel.org/userspace-api/landlock.html
[2]
https://codeberg.org/mark22k/crazytrace/src/commit/c9b3a0e51fadece1228f1f92=
522dccf0115df84d/meson.build#L101
[3]
https://codeberg.org/mark22k/crazytrace/src/commit/c9b3a0e51fadece1228f1f92=
522dccf0115df84d/src/landlock.hpp#L14
[4]
https://codeberg.org/mark22k/crazytrace/src/commit/c9b3a0e51fadece1228f1f92=
522dccf0115df84d/src/main.cpp#L163
[5]
https://codeberg.org/mark22k/crazytrace/src/commit/2580137d0d57b7261bd0e22e=
11853e9e75c2c2a7/meson.build#L122

--=20
Marek K=C3=BCthe
[email protected]
er/ihm he/him

--Sig_/othNkk7hQ9GIp7C7o8luXcX
Content-Type: application/pgp-signature
Content-Description: OpenPGP digital signature

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEmqKBWfzrPNg7whIBfoaRRmmRCMcFAmkeNGkACgkQfoaRRmmR
CMcqZg/+LopRDXWziRPm8iPFgdkgFjs+/i/RRMazqX27QLIuidt06NO0Xogjmus+
HExfw+IWetMjbmCROQme4qj7LFLu7meYWZLnyMflqjqu7Xe1o6W53Xt0xQ9uP/Li
VTKWTMK7BfEWTd0LWL6stykJrwyRiHXBXQSQFKp+u9r3LqcIdFGIfAPSaoT0xxh0
Kzxo0QRv9jdh3KTdHx5dwl1/idLgAKgwrHHL1xS6lE60Vc1VA/GSn6/AhzSTYnRz
KLfqNEwHjy4nlP0tekLg/4Uh/y8VU52NyaD5QSsLvDcuCmgm43Th0KNncz/hBdC4
CUN2wxoMzNsXbHkxcg4yjC5rJHgtzGsNWqF3o/igo+yH6m6+Q8iEM6ocNx271I7l
ImR/Et+Rn59a8Fx46c57aOEuuBuO38K8MW534vP0pVr6R1T3zeW989S+Ydlp0D4O
y3XJykx9K3l84EybsNWdnAh6xoBBRA4KXCrWFEFJNIYX8TK8o4b8pmRAOKW+dB9V
2perdiMxTJ09PKSGWRPq5l2cJCPhPJPbH2ZE4rri9qzzqtzNnRBDWhQwkUXFFo6L
jo5ecFVRcQRW1bVcqF/0TjD0+ZR92ulziDwjjvq2cw7nlaFSo6uGNPs4OsIggW7g
HqLos2c7pkXSOtJWqC3bjVNwEhr8K39VpWly9MOIXZj8vyyPVn8=
=T3fZ
-----END PGP SIGNATURE-----

--Sig_/othNkk7hQ9GIp7C7o8luXcX--