Add ABI v7: log flags - #120
Merged
Merged
Conversation
This was referenced May 7, 2026
l0kod
force-pushed
the
abi-7
branch
2 times, most recently
from
May 20, 2026 09:58
d7d5d39 to
d356103
Compare
Member
Author
|
Depends on #124 |
l0kod
force-pushed
the
abi-7
branch
2 times, most recently
from
May 20, 2026 16:09
f584c5c to
870e351
Compare
Add ABI::V7 for restrict_self log flags introduced with Linux 6.15. Add the syscall flag compatibility framework in a new flags module, parallel to but simpler than the Access/TryCompat machinery. Access types operate on sets of rights with Full/Partial/No compat results; syscall flags are set individually through boolean setters with binary supported/not-supported results. Add SyscallFlag (public sealed marker trait) and SyscallFlagExt (pub(crate) extension: required default_value(), raw_bit(), since(); default try_compat() returning whether the non-default bit should be applied). Add Compatibility::try_compat_binary() factored from the No branch of TryCompat::try_compat() for the shared compat level dispatch. Add SyscallFlagError<F: SyscallFlag> generic error carrying the flag identity and boolean value. Add RestrictSelfFlag (public enum, no #[bitflags], clean names without *Off/*On suffixes). RestrictSelfFlag is not an access right and does not implement the Access trait, which would pull in the AccessError/CompatError generic hierarchy. The polarity mapping (e.g., log_same_exec(false) maps to LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF) is encoded directly in raw_bit() (which returns the OFF/ON UAPI constant) and decoded by is_set() when reporting the effective state. Each flag declares its minimum ABI via since() for per-variant compat gating. The public API is three boolean methods: log_subdomains() on the RestrictSelfAttr trait, and log_same_exec()/log_new_exec() on RulesetCreatedAttr (which gains RestrictSelfAttr as a supertrait so domain-bearing builders share the subdomain setter). The RestrictSelfFlagsState plumbing trait follows the same private module pattern as compat::private::OptionCompatLevelMut. Update RulesetCreated to store requested and actual restrict_self flags as raw u32 bitmasks, pass actual flags to the landlock_restrict_self() syscall, and report the effective state on RestrictionStatus through three new public fields (log_same_exec, log_new_exec, log_subdomains). Append ABI::V7 to all from_all() match arms for AccessFs, AccessNet, Scope, and From<ABI> for BitFlags<Erratum>. Update errata not_backported_yet() and errata_up_to_date test for ABI v7. Re-add LANDLOCK_CRATE_TEST_ABI=7 to the MSRV CI job (previously removed because ABI v7 was not yet defined). Signed-off-by: Mickaël Salaün <mic@digikod.net>
Add the RestrictSelf builder for calling landlock_restrict_self(-1, flags) without creating a Landlock domain. This enables setting restrict_self flags (e.g., muting subdomain audit logs) without creating a ruleset. RestrictSelf uses the same RestrictSelfAttr trait as RulesetCreated, sharing the log_subdomains() setter, and adds an inherent no_new_privs(self, bool) -> Self method mirroring RulesetCreatedAttr::no_new_privs() for the domain-less case. It implements Compatible for per-flag compat level control. RestrictSelf::apply() calls prctl(PR_SET_NO_NEW_PRIVS, 1) by default since the kernel requires no_new_privs (or CAP_SYS_ADMIN) for landlock_restrict_self(2) even with ruleset_fd == -1; use no_new_privs(false) to opt out. Both apply() and RulesetCreated::restrict_self() share the try_set_no_new_privs() helper extracted in the previous commit. apply() returns a RestrictSelfStatus reporting LandlockStatus, no_new_privs, and the log_subdomains flag state. Skips the landlock_restrict_self() syscall when no flags are enforceable. The integration test helper check_restrict_self_support() mirrors the check_ruleset_support() signature (partial, full). A new check_support() helper, generic over the builder and status types, factors out the iteration, thread::spawn, and can_emulate dispatch shared by both helpers. Signed-off-by: Mickaël Salaün <mic@digikod.net>
Bump the example to ABI v7 and add LL_FORCE_LOG environment variable support to enable audit logging of denied accesses after execve(2), matching the kernel's sandboxer example. The setter is wrapped in HardRequirement so that LL_FORCE_LOG=1 fails loudly on kernels without the feature. Remove LL_SCOPED and LL_FORCE_LOG from the child process environment before exec, matching the kernel's unsetenv() calls. Fix a pre-existing bug: LL_SCOPED was not being removed from the child process environment, leaking the variable to spawned commands. Signed-off-by: Mickaël Salaün <mic@digikod.net>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Depends on #119