l j' DdZddlZddlZddlZddlZddlZddlZddlmZm Z m Z m Z ddl Z ddl mZdZdZdZdZd Ze d ZGd d ej*ZGd dej.ZGddej.Zde efdZdede efdZ d#dede j<de de edef dZdede j<de defdZ dede j<de defdZ!dede j<de defdZ"ejFddejHfdZ%ejFddefdZ&ejFddefdZ'ejFddefd Z(ejFddefd!Z)ejFddefd"Z*y)$z Landlock constants and syscalls.N)CallableOptionalTupleTypeVar) SyscallErroriii&TceZdZdZdZ dZ dZ dZ dZ dZ dZ d Z d Z d Z d Z d Z dZ dZ dZ dZ edZedZedZy)FSAccessaFlags representing types of file system actions. These flags enable one to restrict a sandboxed process to a set of actions on files and directories. Files or directories opened before the sandboxing are not subject to these restrictions. ri@ @iiiii icD|j|jzSN)all_fileall_dir)clss ,/usr/libexec/warpinator/landlock/plumbing.pyallz FSAccess.allYs||~ --c|j|jz|jz}tdk\r||jz}tdk\r||j z}|S)N)EXECUTE WRITE_FILE READ_FILElandlock_abi_versionTRUNCATE IOCTL_DEVrflagss rrzFSAccess.all_file]sT cnn,s}}<  !Q & S\\ !E  !Q & S]] "E rcx|j|jz|jz|jz|jz|j z|j z|jz|jz|jz}tdk\r||jz}tdk\r||jz}|S)Nr r) READ_DIR REMOVE_DIR REMOVE_FILE MAKE_CHARMAKE_DIRMAKE_REG MAKE_SOCK MAKE_FIFO MAKE_BLOCKMAKE_SYMr#REFERr%r&s rrzFSAccess.all_dirhs LLnn oo mm ll   ll   mm  mm nn ll   !Q & SYY E  !Q & S]] "E rN)__name__ __module__ __qualname____doc__r r!r"r$r)r*r+r,r-r.r/r0r1r2r3r% classmethodrrrrrr r sGJ(I'HH/J2K$I8H)H4I:I2J4H5 EI ..rr c*eZdZdejfgZy) RulesetAttrhandled_access_fsN)r4r5r6ctypesc_uint64_fields_r9rrr;r;s$foo67Hrr;cDeZdZdejfdej fgZy)PathBeneathAttrallowed_access parent_fdN)r4r5r6r=r>c_int32r?r9rrrArAs! 6??+ fnn%HrrAreturnctj}|dk7rd|Stj}tt t |j ddj d}|dkrd|Sy)NLinuxzDLandlock is a only available on Linux, it looks like you're running -r.)r zQLandlock is only available in kernel 5.13 or newer, it looks like you're running )platformsystemreleasetuplemapintsplit)rLkernel_versionkernel_version_tuples r!find_generic_reason_from_platformrTs __ F --3H 6 %%'N S.*>*>s*CA*F*L*LS*Q!RSg%--;,< > rerrchtjdtjdi}|j|S)NzbCannot find Landlock syscalls - perhaps the kernel was not built with 'CONFIG_SECURITY_LANDLOCK=y'zLandlock has been disabled at boot time. The CONFIG_LSM configuration item should list 'landlock', or, 'lsm=landlock' needs to be added the kernel's command-line arguments (usually via your bootloader).)errnoENOSYS EOPNOTSUPPget)rUerrno_to_reasons rfind_generic_reason_from_errnor\s7 - AO   s ##rresultfunc argumentsreasonc  tj}|dk(r|St|d|j}t xst |xs|}t |tj|d|d|j|d||)NrnamezError calling z: z = r`) r= get_errnogetattrr4rTr\rosstrerror)r]r^r_r`rUrbs rsyscall_errcheckrhs    C ax  4 /D)+  )# .     C b {#fXF  rc tjdtjdtjdtjdi}t ||||j tjS)Nz7Unknown 'flags', or unknown access, or too small 'size'z 'attr' or 'size' inconsistenciesz/Empty 'landlock_ruleset_attr.handled_access_fs') rWEINVALE2BIGEFAULTENOMSGrhrZr=rdr]r^r_r[s rcreate_ruleset_errcheckros] O 7 8 G O i!4!4V5E5E5G!H rc $tjdtjdtjdtjdtj dtj di}t||||jtjS)Nz'flags' is not 0, or inconsistent access in the rule (i.e. 'landlock_path_beneath_attr.allowed_access' is not a subset of the ruleset handled accesses)zAEmpty accesses (e.g. 'landlock_path_beneath_attr.allowed_access')z}'ruleset_fd' is not a file descriptor for the current thread, or a member of 'rule_attr' is not a file descriptor as expectedzr'ruleset_fd' is not a ruleset file descriptor, or a member of 'rule_attr' is not the expected file descriptor typez:'ruleset_fd' has no write access to the underlying rulesetz'rule_attr' inconsistency) rWrjrmEBADFEBADFDEPERMrlrhrZr=rdrns radd_rule_errcheckrts} <  > K O Q 1 O i!4!4V5E5E5G!H rc tjdtjdtjdtjdtj di}t ||||jtjS)Nz'flags' is not 0z<'ruleset_fd' is not a file descriptor for the current threadz-'ruleset_fd' is not a ruleset file descriptoru'ruleset_fd' has no read access to the underlying ruleset, or the current thread is not running with no_new_privs, or it doesn’t have 'CAP_SYS_ADMIN' in its namespacezSThe maximum number of stacked rulesets (16) has been reached for the current thread) rWrjrqrrrsrkrhrZr=rdrns rrestrict_self_errcheckrvsn ( S E A  3 O i!4!4V5E5E5G!H rc tjddS#t$r2}tjdk(rt t |d}~wwxYw)NT) use_errnoWindowsrc)r=CDLL TypeErrorrKrLrrT)es rget_libcr}sL{{4400  ??  )&G&IJPQ Q s A-AAct}tj|dt}d|j_t jt jtt jt jf|j_ t|j_t j|j_|S)Nsyscalllandlock_create_ruleset)r} functoolspartialSYSCALL_CREATE_RULESETr^rbr=c_longPOINTERr;c_size_tc_uint32argtypesroerrcheckrestype)libccreate_rulesets rget_create_rulesetrs :D&&tI8NON8N {# $N $;N "(--N rct}tj|dt}d|j_t jt jt jt jtt jf|j_ t|j_t j|j_|S)Nrlandlock_add_rule)r}rrSYSCALL_ADD_RULEr^rbr=rc_intc_uintrrArrrtrr)radd_rules r get_add_rulers :D  i2BCH,HMM   ' HMM/HMM"MMHMM OrcZt}tj|dt}d|j_t jt jt jf|j_ t|j_ t j|j_ |S)Nrlandlock_restrict_self)r}rrSYSCALL_RESTRICT_SELFr^rbr=rrrrrvrr)r restrict_selfs rget_restrict_selfr"s{ :D%%d9o7LMM6M  #M #9M!'M rc8t}|j}d|_tjtj tj tj tj f|_t|_tj|_ |jS)Nprctl) r}rrbr=rc_ulongrrhrr)rrs r get_prctlr3se :D JJEEJ  EN&ENLLEM ::rc.tddtS)Nr)rCREATE_RULESET_VERSIONr9rrr#r#Gs   a)? @@rr)+r7r=enumrWrrfrKtypingrrrr_ctypeslandlockrrrrrPR_SET_NO_NEW_PRIVSr IntFlagr Structurer;rAstrrTrPr\CFuncPtrrhrortrv lru_cacherzr}rrrrr#r9rrrsW&  55! CLct||cL8&""8f&&8C=* $ $ $RV %%27AI#0 A W-=-= % TU aw'7'7Ea& 1 G,<,<  ST  Q&++QH"Qh$Q 8   Q8&QAcAAr