Revert "Merge pull request netblue30#5315 from ChrysoliteAzalea/landl…

…ock"

This reverts commit 54cb3e7, reversing
changes made to 97b1e02.

There were many issues and requests for changes raised in the pull
request (both code-wise and design-wise) and most of them are still
unresolved[1].

[1] netblue30#5315

config.mk.in

@@ -41,7 +41,6 @@ HAVE_PRIVATE_HOME=@HAVE_PRIVATE_HOME@
 HAVE_IDS=@HAVE_IDS@
 HAVE_GCOV=@HAVE_GCOV@
 HAVE_SELINUX=@HAVE_SELINUX@
-HAVE_LANDLOCK=@HAVE_LANDLOCK@
 HAVE_SUID=@HAVE_SUID@
 HAVE_DBUSPROXY=@HAVE_DBUSPROXY@
 HAVE_USERTMPFS=@HAVE_USERTMPFS@
@@ -50,7 +49,7 @@ HAVE_LTS=@HAVE_LTS@
 HAVE_FORCE_NONEWPRIVS=@HAVE_FORCE_NONEWPRIVS@
 HAVE_ONLY_SYSCFG_PROFILES=@HAVE_ONLY_SYSCFG_PROFILES@
 
-MANFLAGS = $(HAVE_LTS) $(HAVE_OUTPUT) $(HAVE_X11) $(HAVE_PRIVATE_HOME) $(HAVE_APPARMOR) $(HAVE_IDS) $(HAVE_OVERLAYFS) $(HAVE_USERTMPFS) $(HAVE_DBUSPROXY) $(HAVE_FIRETUNNEL) $(HAVE_GLOBALCFG) $(HAVE_CHROOT) $(HAVE_NETWORK) $(HAVE_USERNS) $(HAVE_FILE_TRANSFER) $(HAVE_SELINUX) $(HAVE_SUID) $(HAVE_LANDLOCK) $(HAVE_FORCE_NONEWPRIVS) $(HAVE_ONLY_SYSCFG_PROFILES)
+MANFLAGS = $(HAVE_LTS) $(HAVE_OUTPUT) $(HAVE_X11) $(HAVE_PRIVATE_HOME) $(HAVE_APPARMOR) $(HAVE_IDS) $(HAVE_OVERLAYFS) $(HAVE_USERTMPFS) $(HAVE_DBUSPROXY) $(HAVE_FIRETUNNEL) $(HAVE_GLOBALCFG) $(HAVE_CHROOT) $(HAVE_NETWORK) $(HAVE_USERNS) $(HAVE_FILE_TRANSFER) $(HAVE_SELINUX) $(HAVE_SUID) $(HAVE_FORCE_NONEWPRIVS) $(HAVE_ONLY_SYSCFG_PROFILES)
 
 CC=@CC@
 CFLAGS=@CFLAGS@

configure

@@ -652,7 +652,6 @@ HAVE_DBUSPROXY
 EXTRA_LDFLAGS
 EXTRA_CFLAGS
 HAVE_SELINUX
-HAVE_LANDLOCK
 AA_LIBS
 AA_CFLAGS
 PKG_CONFIG_LIBDIR
@@ -714,7 +713,6 @@ enable_sanitizer
 enable_ids
 enable_apparmor
 enable_selinux
-enable_landlock
 enable_dbusproxy
 enable_output
 enable_usertmpfs
@@ -1376,7 +1374,6 @@ Optional Features:
   --enable-ids            enable ids
   --enable-apparmor       enable apparmor
   --enable-selinux        SELinux labeling support
-  --enable-landlock       Landlock self-restriction support
   --disable-dbusproxy     disable dbus proxy
   --disable-output        disable --output logging
   --disable-usertmpfs     disable tmpfs as regular user
@@ -3345,19 +3342,7 @@ if test "x$enable_selinux" = "xyes"; then :
 
 fi
 
-HAVE_LANDLOCK=""
 
-# Check whether --enable-landlock was given.
-if test "${enable_landlock+set}" = set; then :
-  enableval=$enable_landlock;
-fi
-
-if test "x$enable_landlock" = "xyes"; then :
-
-	HAVE_LANDLOCK="-DHAVE_LANDLOCK"
-	EXTRA_LDFLAGS="$EXTRA_LDFLAGS"
-
-fi
 
 
 
@@ -5292,7 +5277,6 @@ Features:
    overlayfs support: $HAVE_OVERLAYFS
    private home support: $HAVE_PRIVATE_HOME
    SELinux labeling support: $HAVE_SELINUX
-   Landlock self-restriction support: $HAVE_LANDLOCK
    user namespace: $HAVE_USERNS
    X11 sandboxing support: $HAVE_X11
 

configure.ac

@@ -81,18 +81,10 @@ AS_IF([test "x$enable_selinux" = "xyes"], [
 	EXTRA_LDFLAGS="$EXTRA_LDFLAGS -lselinux"
 ])
 
-HAVE_LANDLOCK=""
-AC_SUBST([HAVE_LANDLOCK])
-AC_ARG_ENABLE([landlock])
-    [AS_HELP_STRING([--enable-landlock], [Landlock self-restriction support])]
-AS_IF([test "x$enable_landlock" = "xyes"], [
-	HAVE_LANDLOCK="-DHAVE_LANDLOCK"
-	EXTRA_LDFLAGS="$EXTRA_LDFLAGS"
-])
-
 AC_SUBST([EXTRA_CFLAGS])
 AC_SUBST([EXTRA_LDFLAGS])
 
+
 HAVE_DBUSPROXY=""
 AC_SUBST([HAVE_DBUSPROXY])
 AC_ARG_ENABLE([dbusproxy],

contrib/vim/syntax/firejail.vim

@@ -52,7 +52,7 @@ syn match fjVar /\v\$\{(CFG|DESKTOP|DOCUMENTS|DOWNLOADS|HOME|MUSIC|PATH|PICTURES
 
 " Commands grabbed from: src/firejail/profile.c
 " Generate list with: { rg -o 'strn?cmp\(ptr, "([^"]+) "' -r '$1' src/firejail/profile.c; echo private-lib; } | grep -vEx '(include|ignore|caps\.drop|caps\.keep|protocol|restrict-namespaces|seccomp|seccomp\.drop|seccomp\.keep|env|rmenv|net|ip)' | sort -u | tr $'\n' '|' # private-lib is special-cased in the code and doesn't match the regex; grep-ed patterns are handled later with 'syn match nextgroup=' directives (except for include which is special-cased as a fjCommandNoCond keyword)
-syn match fjCommand /\v(apparmor|bind|blacklist|blacklist-nolog|cpu|defaultgw|dns|hostname|hosts-file|ip6|iprange|join-or-start|landlock|landlock.proc|landlock.read|landlock.write|landlock.special|landlock.execute|mac|mkdir|mkfile|mtu|name|netfilter|netfilter6|netmask|nice|noblacklist|noexec|nowhitelist|overlay-named|private|private-bin|private-cwd|private-etc|private-home|private-lib|private-opt|private-srv|read-only|read-write|rlimit-as|rlimit-cpu|rlimit-fsize|rlimit-nofile|rlimit-nproc|rlimit-sigpending|timeout|tmpfs|veth-name|whitelist|xephyr-screen) / skipwhite contained
+syn match fjCommand /\v(apparmor|bind|blacklist|blacklist-nolog|cpu|defaultgw|dns|hostname|hosts-file|ip6|iprange|join-or-start|mac|mkdir|mkfile|mtu|name|netfilter|netfilter6|netmask|nice|noblacklist|noexec|nowhitelist|overlay-named|private|private-bin|private-cwd|private-etc|private-home|private-lib|private-opt|private-srv|read-only|read-write|rlimit-as|rlimit-cpu|rlimit-fsize|rlimit-nofile|rlimit-nproc|rlimit-sigpending|timeout|tmpfs|veth-name|whitelist|xephyr-screen) / skipwhite contained
 " Generate list with: rg -o 'strn?cmp\(ptr, "([^ "]*[^ ])"' -r '$1' src/firejail/profile.c | grep -vEx '(include|rlimit|quiet)' | sed -e 's/\./\\./' | sort -u | tr $'\n' '|' # include/rlimit are false positives, quiet is special-cased below
 syn match fjCommand /\v(allow-debuggers|allusers|apparmor|caps|deterministic-exit-code|deterministic-shutdown|disable-mnt|ipc-namespace|keep-config-pulse|keep-dev-shm|keep-fd|keep-var-tmp|machine-id|memory-deny-write-execute|netfilter|no3d|noautopulse|nodbus|nodvd|nogroups|noinput|nonewprivs|noprinters|noroot|nosound|notv|nou2f|novideo|overlay|overlay-tmpfs|private|private-cache|private-cwd|private-dev|private-lib|private-tmp|seccomp|seccomp\.32|seccomp\.block-secondary|tracelog|writable-etc|writable-run-user|writable-var|writable-var-log|x11)$/ contained
 syn match fjCommand /ignore / nextgroup=fjCommand,fjCommandNoCond skipwhite contained

src/bash_completion/firejail.bash_completion.in

@@ -42,22 +42,6 @@ _firejail()
             _filedir -d
             return 0
             ;;
-        --landlock.read)
-            _filedir
-            return 0
-            ;;
-        --landlock.write)
-            _filedir
-            return 0
-            ;;
-        --landlock.special)
-            _filedir
-            return 0
-            ;;
-        --landlock.execute)
-            _filedir
-            return 0
-            ;;
         --tmpfs)
             _filedir
             return 0

src/firejail/firejail.h

@@ -22,35 +22,14 @@
 #include "../include/common.h"
 #include "../include/euid_common.h"
 #include "../include/rundefs.h"
-#ifdef HAVE_LANDLOCK
-#include <linux/landlock.h>
-#endif
 #include <linux/limits.h> // Note: Plain limits.h may break ARG_MAX (see #4583)
 #include <stdarg.h>
 #include <sys/stat.h>
 
 // debug restricted shell
 //#define DEBUG_RESTRICTED_SHELL
 
-#ifdef HAVE_LANDLOCK
-
-extern int landlock_create_ruleset(struct landlock_ruleset_attr *rsattr,size_t size,__u32 flags);
-
-extern int landlock_add_rule(int fd,enum landlock_rule_type t,void *attr,__u32 flags);
-
-extern int landlock_restrict_self(int fd,__u32 flags);
-
-extern int create_full_ruleset();
-
-extern int add_read_access_rule_by_path(int rset_fd,char *allowed_path);
 
-extern int add_write_access_rule_by_path(int rset_fd,char *allowed_path);
-
-extern int add_create_special_rule_by_path(int rset_fd,char *allowed_path);
-
-extern int add_execute_rule_by_path(int rset_fd,char *allowed_path);
-
-#endif
 
 // profiles
 #define DEFAULT_USER_PROFILE	"default"
@@ -307,11 +286,6 @@ extern int arg_seccomp32;	// enable default seccomp filter for 32 bit arch
 extern int arg_seccomp_postexec;	// need postexec ld.preload library?
 extern int arg_seccomp_block_secondary;	// block any secondary architectures
 
-#ifdef HAVE_LANDLOCK
-extern int arg_landlock; // Landlock ruleset file descriptor
-extern int arg_landlock_proc;				// Landlock rule for accessing /proc (0 for no access, 1 for read-only and 2 for read-write)
-#endif
-
 extern int arg_caps_default_filter;	// enable default capabilities filter
 extern int arg_caps_drop;		// drop list
 extern int arg_caps_drop_all;		// drop all capabilities

src/firejail/main.c

@@ -81,11 +81,6 @@ int arg_seccomp_postexec = 0;			// need postexec ld.preload library?
 int arg_seccomp_block_secondary = 0;		// block any secondary architectures
 int arg_seccomp_error_action = 0;
 
-#ifdef HAVE_LANDLOCK
-int arg_landlock = -1;				// Landlock ruleset file descriptor (-1 if it doesn't exist)
-int arg_landlock_proc = 0;				// Landlock rule for accessing /proc (0 for no access, 1 for read-only and 2 for read-write)
-#endif
-
 int arg_caps_default_filter = 0;			// enable default capabilities filter
 int arg_caps_drop = 0;				// drop list
 int arg_caps_drop_all = 0;			// drop all capabilities
@@ -1406,82 +1401,6 @@ int main(int argc, char **argv, char **envp) {
 			else
 				exit_err_feature("seccomp");
 		}
-#ifdef HAVE_LANDLOCK
-		else if (strcmp(argv[i], "--landlock") == 0) {
-			if (arg_landlock == -1) arg_landlock = create_full_ruleset();
-			const char *home_dir = env_get("HOME");
-			int home_fd = open(home_dir,O_PATH | O_CLOEXEC);
-			struct landlock_path_beneath_attr target;
-			target.parent_fd = home_fd;
-			target.allowed_access = LANDLOCK_ACCESS_FS_READ_FILE | LANDLOCK_ACCESS_FS_READ_DIR | LANDLOCK_ACCESS_FS_WRITE_FILE | LANDLOCK_ACCESS_FS_REMOVE_FILE | LANDLOCK_ACCESS_FS_REMOVE_DIR | LANDLOCK_ACCESS_FS_MAKE_CHAR | LANDLOCK_ACCESS_FS_MAKE_DIR | LANDLOCK_ACCESS_FS_MAKE_REG | LANDLOCK_ACCESS_FS_MAKE_SYM;
-			if (landlock_add_rule(arg_landlock,LANDLOCK_RULE_PATH_BENEATH,&target,0)) {
-				fprintf(stderr,"An error has occured while adding a rule to the Landlock ruleset.\n");
-			}
-			close(home_fd);
-			if (add_read_access_rule_by_path(arg_landlock, "/bin/")) {
-				fprintf(stderr,"An error has occured while adding a rule to the Landlock ruleset.\n");
-			}
-			if (add_execute_rule_by_path(arg_landlock, "/bin/")) {
-				fprintf(stderr,"An error has occured while adding a rule to the Landlock ruleset.\n");
-			}
-			if (add_read_access_rule_by_path(arg_landlock, "/dev/")) {
-				fprintf(stderr,"An error has occured while adding a rule to the Landlock ruleset.\n");
-			}
-			if (add_read_access_rule_by_path(arg_landlock, "/etc/")) {
-				fprintf(stderr,"An error has occured while adding a rule to the Landlock ruleset.\n");
-			}
-			if (add_read_access_rule_by_path(arg_landlock, "/lib/")) {
-				fprintf(stderr,"An error has occured while adding a rule to the Landlock ruleset.\n");
-			}
-			if (add_execute_rule_by_path(arg_landlock, "/lib/")) {
-				fprintf(stderr,"An error has occured while adding a rule to the Landlock ruleset.\n");
-			}
-			if (add_read_access_rule_by_path(arg_landlock, "/opt/")) {
-				fprintf(stderr,"An error has occured while adding a rule to the Landlock ruleset.\n");
-			}
-			if (add_execute_rule_by_path(arg_landlock, "/opt/")) {
-				fprintf(stderr,"An error has occured while adding a rule to the Landlock ruleset.\n");
-			}
-			if (add_read_access_rule_by_path(arg_landlock, "/usr/")) {
-				fprintf(stderr,"An error has occured while adding a rule to the Landlock ruleset.\n");
-			}
-			if (add_execute_rule_by_path(arg_landlock, "/usr/")) {
-				fprintf(stderr,"An error has occured while adding a rule to the Landlock ruleset.\n");
-			}
-			if (add_read_access_rule_by_path(arg_landlock, "/var/")) {
-				fprintf(stderr,"An error has occured while adding a rule to the Landlock ruleset.\n");
-			}
-		}
-		else if (strncmp(argv[i], "--landlock.proc=", 16) == 0) {
-			if (strncmp(argv[i]+16, "no", 2) == 0) arg_landlock_proc = 0;
-			else if (strncmp(argv[i]+16, "ro", 2) == 0) arg_landlock_proc = 1;
-			else if (strncmp(argv[i]+16, "rw", 2) == 0) arg_landlock_proc = 2;
-		}
-		else if (strncmp(argv[i], "--landlock.read=", 16) == 0) {
-			if (arg_landlock == -1) arg_landlock = create_full_ruleset();
-			if (add_read_access_rule_by_path(arg_landlock, argv[i]+16)) {
-				fprintf(stderr,"An error has occured while adding a rule to the Landlock ruleset.\n");
-			}
-		}
-		else if (strncmp(argv[i], "--landlock.write=", 17) == 0) {
-			if (arg_landlock == -1) arg_landlock = create_full_ruleset();
-			if (add_write_access_rule_by_path(arg_landlock, argv[i]+17)) {
-				fprintf(stderr,"An error has occured while adding a rule to the Landlock ruleset.\n");
-			}
-		}
-		else if (strncmp(argv[i], "--landlock.special=", 17) == 0) {
-			if (arg_landlock == -1) arg_landlock = create_full_ruleset();
-			if (add_create_special_rule_by_path(arg_landlock, argv[i]+17)) {
-				fprintf(stderr,"An error has occured while adding a rule to the Landlock ruleset.\n");
-			}
-		}
-		else if (strncmp(argv[i], "--landlock.execute=", 19) == 0) {
-			if (arg_landlock == -1) arg_landlock = create_full_ruleset();
-			if (add_execute_rule_by_path(arg_landlock, argv[i]+19)) {
-				fprintf(stderr,"An error has occured while adding a rule to the Landlock ruleset.\n");
-			}
-		}
-#endif
 		else if (strcmp(argv[i], "--memory-deny-write-execute") == 0) {
 			if (checkcfg(CFG_SECCOMP))
 				arg_memory_deny_write_execute = 1;