Re: Landlock setup

On 16/12/2022 10:53, Yves Rutschle wrote:
> Hi Mickaël,
> 
> On Fri, Dec 16, 2022 at 10:44:45AM +0100, Mickaël Salaün wrote:
>> Hi Yves,
>>
>> How did your investigation to use Landlock go?
> 
> I havent had time to dig much into it. Something I thought
> might be a problem is that I retrieved landlock.h from your
> git, and I wondered it might be different to what is
> required to work with my stock kernel.

You can get any Linux's mainline landlock.h [1] and update them from 
time to time, their API will be backward compatible. You can either use 
a standalone copy of this file or rely on libc's headers with a build 
configuration like AC_CHECK_HEADERS([linux/landlock.h]). See [2] for a 
full standalone example.

[1] 
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/include/uapi/linux/landlock.h
[2] 
https://github.com/OISF/suricata/pull/7853/commits/485d5a4ea46dd90e228b3e4856b95a67a51d348c

Relying on a standalone copy has the advantage of to require a simpler 
code with less static check to make sure a specific feature/type is 
defined in the header file. Indeed, over time, Landlock and this related 
header file will get new fields (e.g. LANDLOCK_ACCESS_FS_REFER, 
LANDLOCK_ACCESS_FS_TRUNCATE) and type definitions.


> 
> I'm hoping to find some time to look at this over the
> holidays...

Feel free to post updates and Cc @l0kod in the related GitHub PR.

Enjoy your holidays!
  Mickaël

> 
> 
> Cheers,
> Y.
>