1 /* Copyright 2022 The ChromiumOS Authors 2 * Use of this source code is governed by a BSD-style license that can be 3 * found in the LICENSE file. 4 */ 5 6 /* 7 * Landlock system definitions. 8 * 9 * These definitions are based on <linux/landlock.h>. However, because we 10 * can't guarantee that header will be available on all systems that need to 11 * build Minijail, they are extracted here. 12 */ 13 14 #ifndef _LANDLOCK_H 15 #define _LANDLOCK_H 16 17 #include <linux/types.h> 18 19 /** 20 * struct landlock_ruleset_attr - Ruleset definition 21 * 22 * Argument of sys_landlock_create_ruleset(). This structure can grow in 23 * future versions. 24 */ 25 struct minijail_landlock_ruleset_attr { 26 /** 27 * @handled_access_fs: Bitmask of actions (cf. `Filesystem flags`_) 28 * that is handled by this ruleset and should then be forbidden if no 29 * rule explicitly allow them. This is needed for backward 30 * compatibility reasons. 31 */ 32 __u64 handled_access_fs; 33 }; 34 35 /* 36 * sys_landlock_create_ruleset() flags: 37 * 38 * - %LANDLOCK_CREATE_RULESET_VERSION: Get the highest supported Landlock ABI 39 * version. 40 */ 41 #ifndef LANDLOCK_CREATE_RULESET_VERSION 42 #define LANDLOCK_CREATE_RULESET_VERSION (1U << 0) 43 #endif 44 45 /** 46 * enum landlock_rule_type - Landlock rule type 47 * 48 * Argument of sys_landlock_add_rule(). 49 */ 50 enum minijail_landlock_rule_type { 51 /** 52 * @LANDLOCK_RULE_PATH_BENEATH: Type of a &struct 53 * landlock_path_beneath_attr . 54 */ 55 LANDLOCK_RULE_PATH_BENEATH = 1, 56 }; 57 58 /** 59 * struct landlock_path_beneath_attr - Path hierarchy definition 60 * 61 * Argument of sys_landlock_add_rule(). 62 */ 63 struct minijail_landlock_path_beneath_attr { 64 /** 65 * @allowed_access: Bitmask of allowed actions for this file hierarchy 66 * (cf. `Filesystem flags`_). 67 */ 68 __u64 allowed_access; 69 /** 70 * @parent_fd: File descriptor, open with ``O_PATH``, which identifies 71 * the parent directory of a file hierarchy, or just a file. 72 */ 73 __s32 parent_fd; 74 /* 75 * This struct is packed to avoid trailing reserved members. 76 * Cf. security/landlock/syscalls.c:build_check_abi() 77 */ 78 } __attribute__((__packed__)); 79 80 #ifndef LANDLOCK_ACCESS_FS_EXECUTE 81 #define LANDLOCK_ACCESS_FS_EXECUTE (1ULL << 0) 82 #endif 83 84 #ifndef LANDLOCK_ACCESS_FS_WRITE_FILE 85 #define LANDLOCK_ACCESS_FS_WRITE_FILE (1ULL << 1) 86 #endif 87 88 #ifndef LANDLOCK_ACCESS_FS_READ_FILE 89 #define LANDLOCK_ACCESS_FS_READ_FILE (1ULL << 2) 90 #endif 91 92 #ifndef LANDLOCK_ACCESS_FS_READ_DIR 93 #define LANDLOCK_ACCESS_FS_READ_DIR (1ULL << 3) 94 #endif 95 96 #ifndef LANDLOCK_ACCESS_FS_REMOVE_DIR 97 #define LANDLOCK_ACCESS_FS_REMOVE_DIR (1ULL << 4) 98 #endif 99 100 #ifndef LANDLOCK_ACCESS_FS_REMOVE_FILE 101 #define LANDLOCK_ACCESS_FS_REMOVE_FILE (1ULL << 5) 102 #endif 103 104 #ifndef LANDLOCK_ACCESS_FS_MAKE_CHAR 105 #define LANDLOCK_ACCESS_FS_MAKE_CHAR (1ULL << 6) 106 #endif 107 108 #ifndef LANDLOCK_ACCESS_FS_MAKE_DIR 109 #define LANDLOCK_ACCESS_FS_MAKE_DIR (1ULL << 7) 110 #endif 111 112 #ifndef LANDLOCK_ACCESS_FS_MAKE_REG 113 #define LANDLOCK_ACCESS_FS_MAKE_REG (1ULL << 8) 114 #endif 115 116 #ifndef LANDLOCK_ACCESS_FS_MAKE_SOCK 117 #define LANDLOCK_ACCESS_FS_MAKE_SOCK (1ULL << 9) 118 #endif 119 120 #ifndef LANDLOCK_ACCESS_FS_MAKE_FIFO 121 #define LANDLOCK_ACCESS_FS_MAKE_FIFO (1ULL << 10) 122 #endif 123 124 #ifndef LANDLOCK_ACCESS_FS_MAKE_BLOCK 125 #define LANDLOCK_ACCESS_FS_MAKE_BLOCK (1ULL << 11) 126 #endif 127 128 #ifndef LANDLOCK_ACCESS_FS_MAKE_SYM 129 #define LANDLOCK_ACCESS_FS_MAKE_SYM (1ULL << 12) 130 #endif 131 132 #endif /* _LANDLOCK_H */ 133